DEBIAN-CVE-2026-121127: Use After Free
Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Debian chromium package are in scope. The vulnerability affects Chromium-based browser code prior to version 157.0.8103.38; no Debian package version information is provided.
What does an attacker need to exploit it?
The attacker can be remote and does not need privileges, but the user must interact with a crafted HTML page. Exploitation has low attack complexity according to the supplied vector.
Does successful exploitation provide code execution outside the browser sandbox?
The provided information states that arbitrary code execution occurs inside the sandbox. It does not establish execution outside the sandbox or compromise of the underlying operating system.