DEBIAN-CVE-2026-121071: Critical severity debian/chromium vulnerability
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must get a user to interact with a crafted HTML page. The vulnerability is remotely reachable and does not require attacker privileges.
What is the potential impact if exploitation succeeds?
A successful attack could allow arbitrary code execution outside Chrome's sandbox, with high impact to confidentiality, integrity, and availability.
Which installations should be considered exposed?
Debian systems using the chromium package are affected if they run a Google Chrome version prior to 157.0.8103.38. The provided data does not state a Debian-fixed package version or any configuration prerequisite.