DEBIAN-CVE-2026-121104: Critical severity debian/chromium vulnerability
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must induce a user to interact with a crafted HTML page. The vulnerability is remotely reachable and does not require the attacker to have prior privileges.
What is the potential impact if exploitation succeeds?
Successful exploitation could allow arbitrary code execution outside Chromium's sandbox, with high impact to confidentiality, integrity, and availability.
Which Debian software is identified as affected?
The affected software identified in the available data is Debian's chromium package. The data states that Google Chrome versions prior to 157.0.8103.38 are affected, but does not provide the corresponding Debian package version.