DEBIAN-CVE-2026-121064: Input Validation
Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low)
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Debian chromium package are exposed if they use a Chrome version earlier than 157.0.8103.38. Exploitation requires a local attacker able to run a program on the affected system.
Can this be exploited remotely through web content alone?
The available information describes exploitation by a local program and does not indicate that web content alone is sufficient. The reported impact is arbitrary code execution inside the sandbox.
What is the immediate mitigation if updating is not possible?
Limit untrusted users' ability to execute local programs on systems running the affected chromium package. This reduces the stated local attack path, though no product-specific workaround is provided.