DEBIAN-CVE-2026-121112: High severity debian/chromium vulnerability
Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
What must an attacker achieve before this flaw can be used to escape the browser sandbox?
The attacker must first compromise the Chromium renderer process. Exploitation then involves a crafted HTML page and may allow arbitrary code execution outside the sandbox.
Is user interaction required?
Yes. The supplied vector includes UI:R, indicating that user interaction is required. The vulnerability description identifies a crafted HTML page as part of the attack.
Which Chromium versions are affected according to the available information?
Google Chrome versions prior to 157.0.8103.38 are described as affected. The provided data does not identify the corresponding fixed Debian chromium package version.