DEBIAN-CVE-2026-121082: High severity debian/chromium vulnerability
Published Nov 3, 2026
·Updated
Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Who is exposed to this issue?
Users of Debian's chromium package are exposed when they use a version earlier than 157.0.8103.38 and render attacker-crafted HTML content.
2
What does an attacker need to exploit it?
The vulnerability is remotely exploitable with low attack complexity and requires no privileges. It requires user interaction, specifically causing the target to process a crafted HTML page.
3
What is the impact if exploitation succeeds?
Successful exploitation can allow arbitrary code execution inside the Chrome sandbox, with high confidentiality, integrity, and availability impact.