DEBIAN-CVE-2026-121075: Debian/chromium vulnerability

Published Nov 3, 2026

Updated

Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

3 affected components

debian/chromium*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 157.0.8103.38

Event History

Nov 3, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionAffected Software

Frequently Asked Questions

Which systems are in scope?

The affected software listed is Debian's chromium package. The issue applies to Google Chrome versions earlier than 157.0.8103.38; the provided data does not map that upstream version to a specific Debian package version.

What must an attacker do to exploit this issue?

The attacker must use social engineering to get a target to interact with a crafted HTML page. The issue is described as remotely exploitable and does not indicate that the attacker needs prior local access.