DEBIAN-CVE-2026-121098: High severity debian/chromium vulnerability
Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an authenticated browser user or user interaction?
The vulnerability has no privilege requirement, but user interaction is required. The attacker must also have already compromised the renderer process before attempting to escape the sandbox with crafted HTML.
What is the potential impact if the sandbox escape succeeds?
A successful exploit could allow arbitrary code execution outside the browser sandbox. The listed impact includes high confidentiality, integrity, and availability effects.
Which version boundary is provided for remediation?
The issue affects Google Chrome versions before 157.0.8103.38. The supplied data does not provide a corresponding Debian Chromium package version or fix status.