DEBIAN-CVE-2026-121115: Input Validation
Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 157.0.8103.38
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to send crafted network traffic to a vulnerable Chrome instance. The available information does not state that local access, authentication, or user interaction is required.
Which systems are affected?
The affected software entry is Debian's chromium package. The issue affects Google Chrome versions prior to 157.0.8103.38; no Debian package version or fixed version is provided.
What should be done if patching cannot happen immediately?
No workaround or mitigation is provided in the available data. Prioritize reducing exposure to untrusted network traffic until an updated Chromium package can be deployed.