DEBIAN-CVE-2026-121092: High severity debian/chromium vulnerability
Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Debian's chromium package are exposed when they browse to or otherwise render attacker-controlled HTML containing crafted SVG content. Exploitation requires user interaction because the victim must load the crafted page.
Does exploitation require an attacker to have an account or local access?
No. The vector is network-based and requires no privileges, although the attacker must persuade or cause a user to open a crafted HTML page.
What is the potential impact if exploitation succeeds?
A remote attacker could potentially execute arbitrary code inside the Chromium sandbox. The reported impact includes high confidentiality, integrity, and availability effects.