DEBIAN-CVE-2026-121057: High severity debian/chromium vulnerability
Published Nov 3, 2026
·Updated
Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
The attacker needs to deliver a crafted HTML page and have a user interact with it. The attack can be conducted remotely and does not require attacker privileges.
2
Does successful exploitation break out of the browser sandbox?
The reported impact is arbitrary code execution inside the sandbox. The provided information does not indicate a sandbox escape.
3
Which installations should be prioritized for investigation?
Debian systems using Chromium should be prioritized, particularly where users can browse untrusted websites or open untrusted HTML content. The issue is rated high severity with impacts to confidentiality, integrity, and availability.