DEBIAN-CVE-2026-121101: Debian/chromium vulnerability
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 157.0.8103.38
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must use social engineering to get the victim to interact with a crafted Chrome extension. The issue can then be used to bypass system access restrictions and reach a privileged page.
Who should prioritize remediation?
Systems using the Debian chromium package should be assessed, particularly where users can install or be persuaded to use browser extensions. The affected upstream Chrome versions are those prior to 157.0.8103.38.
How can I determine whether a Debian system is affected?
Check the installed Debian chromium package version against Debian security-tracker guidance for CVE-2026-121101. The provided data does not identify the Debian package version containing the fix.