DEBIAN-CVE-2026-121117: Use After Free
Published Nov 3, 2026
·Updated
Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What must an attacker have to exploit this issue?
The attacker can be remote and does not need prior privileges. User interaction is required, and exploitation involves a crafted HTML page.
2
Does the available information indicate a sandbox escape?
No. The reported impact is arbitrary code execution inside the sandbox; the data does not state that the attacker can escape the sandbox.
3
Which deployments should be prioritized for review?
Review Debian systems using Chromium, particularly where users may be induced to interact with untrusted web content. The issue affects Chrome versions prior to 157.0.8103.38.