DEBIAN-CVE-2026-121087: Input Validation
Published Nov 3, 2026
·Updated
Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker needs to induce a user to load a crafted HTML page in an affected Chromium installation. The available information describes the attack as remote and does not state that authentication or local access is required.
2
Which installations should be prioritized for remediation?
Debian systems using Chromium versions earlier than 157.0.8103.38 should be prioritized. The issue is rated High by Chromium and may allow web origin policy bypass through crafted HTML content.