DEBIAN-CVE-2026-121048: Race Condition
Published Nov 3, 2026
·Updated
Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
An attacker must induce a user to open a crafted HTML page. Exploitation is remote and requires no attacker privileges, but it requires user interaction.
2
What is the impact if exploitation succeeds?
A successful exploit can execute arbitrary code inside the browser sandbox. The reported impact includes high confidentiality, integrity, and availability effects.
3
Which Chromium versions are affected?
The issue affects Google Chrome versions prior to 157.0.8103.38. The provided data identifies the affected Debian software as chromium, but does not specify the corresponding fixed Debian package version.