DEBIAN-CVE-2026-121085: Debian/chromium vulnerability
Published Nov 3, 2026
·Updated
Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 157.0.8103.38
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionAffected Software
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
The attacker must induce the victim to load a crafted HTML page remotely. The flaw then allows bypass of system access restrictions to a privileged Chrome WebUI page.
2
Which Debian systems are potentially affected?
Systems using the Debian chromium package may be affected if they run a version of Google Chrome prior to 157.0.8103.38. The provided information does not identify specific Debian package versions or configurations.