DEBIAN-CVE-2026-121070: Use After Free
Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Debian's chromium package are exposed when they browse to a crafted HTML page in an affected version. The issue can be triggered remotely and does not require attacker privileges, but it does require user interaction.
What access does an attacker gain if exploitation succeeds?
Successful exploitation can allow arbitrary code execution inside the browser sandbox. The provided information does not indicate sandbox escape or host-level code execution.
Which versions need to be remediated?
Chromium versions prior to 157.0.8103.38 are affected according to the vulnerability information. The data does not provide the corresponding Debian package version.