DEBIAN-CVE-2026-121084: High severity debian/chromium vulnerability
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
What must an attacker achieve before this vulnerability can be used to escape the sandbox?
The attacker must first compromise the Chromium renderer process. They can then use a crafted HTML page to trigger the out-of-bounds read and execute code outside the sandbox.
Does exploitation require user interaction?
Yes. The supplied vector includes UI:R, indicating user interaction is required, though the available data does not specify the exact interaction.
How can I assess whether my Debian Chromium package is affected?
The vulnerability is described as affecting Google Chrome versions before 157.0.8103.38. The provided data does not include the corresponding fixed Debian Chromium package version, so it cannot establish affected status from a Debian package version alone.