DEBIAN-CVE-2026-121054: Debian/chromium vulnerability
Published Nov 3, 2026
·Updated
Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker needs to persuade a victim to load a crafted HTML page remotely. The issue is described as allowing a bypass of the web origin policy.
2
Which Chromium versions are affected?
Google Chrome versions prior to 157.0.8103.38 are affected according to the provided advisory. The supplied data does not identify the corresponding fixed Debian Chromium package version.