DEBIAN-CVE-2026-121042: Debian/chromium vulnerability

Published Nov 3, 2026

Updated

Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

3 affected components

debian/chromium*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Chrome on Android to a version that resolves this vulnerability.
Fixed in 157.0.8103.38

Event History

Nov 3, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects Google Chrome on Android before version 157.0.8103.38. The provided data identifies Debian Chromium as the tracked software, but does not specify affected Debian package versions or configurations.

What does an attacker need to exploit this vulnerability?

An attacker needs to induce the target to load a crafted HTML page remotely. No local access or prior authentication requirement is stated in the provided data.

What is the security impact of successful exploitation?

Successful exploitation allows bypassing system access restrictions because of incorrect authorization handling in Permissions. The Chromium security severity is rated Medium.