DEBIAN-CVE-2026-121036: Use After Free
Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to persuade a user to load a crafted HTML page. The issue is remotely reachable and requires no attacker privileges, but user interaction is required.
Is the impact limited to the browser sandbox?
The reported arbitrary code execution occurs inside the sandbox. The provided data does not indicate that the vulnerability allows escape from the sandbox or compromise of the underlying system outside it.
Which Debian software should be prioritized for remediation?
Debian systems using the chromium package should be prioritized. The issue affects Google Chrome versions prior to 157.0.8103.38; the provided data does not state the corresponding Debian package version.