DEBIAN-CVE-2026-121076: Use After Free
Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to persuade a user to interact with a crafted HTML page. No prior privileges are required, and the attack can be delivered remotely.
What is the potential impact if exploitation succeeds?
Successful exploitation can allow arbitrary code execution outside the browser sandbox. The reported impact includes compromise of confidentiality, integrity, and availability.
Which component should be prioritized for remediation?
Prioritize Debian systems running the chromium package, particularly where users browse untrusted websites or may be exposed to social-engineering attacks. The issue affects Google Chrome versions before 157.0.8103.38; no Debian package version is provided here.