DEBIAN-CVE-2026-121100: Use After Free
Published Nov 3, 2026
·Updated
Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
The attacker must induce a user to open or interact with a crafted HTML page. The vulnerability is remotely reachable and requires no attacker privileges, but user interaction is required.
2
What is the impact if exploitation succeeds?
Successful exploitation can allow arbitrary code execution inside the browser sandbox. The reported impact includes high confidentiality, integrity, and availability effects.
3
Which Chromium versions are vulnerable?
Google Chrome versions prior to 157.0.8103.38 are described as affected. The provided data identifies Debian's chromium package but does not state the corresponding fixed Debian package version.