DEBIAN-CVE-2026-121047: Buffer Overflow
Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker does not need prior privileges or authentication. Exploitation requires a user to interact with a crafted HTML page, such as by opening or visiting it.
Who is most exposed?
Users of affected browser versions who can be induced to visit attacker-controlled or otherwise malicious HTML content are exposed. The reported attack vector is network-based, but user interaction is required.
Is the reported code execution outside the browser sandbox?
No. The available information states that arbitrary code execution occurs inside the sandbox; it does not claim a sandbox escape.
How can I determine whether a Debian Chromium installation is affected?
The advisory identifies Google Chrome versions prior to 157.0.8103.38, but it does not provide the corresponding Debian Chromium package version or a Debian fixed version. Verify the installed Debian package against Debian's security tracking information.