DEBIAN-CVE-2026-121129: Use After Free
Published Nov 3, 2026
·Updated
Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which deployments are exposed?
Debian systems running Chromium versions earlier than 157.0.8103.38 are affected. Exploitation requires a user to load an attacker-crafted HTML page.
2
What does an attacker need to exploit this issue?
The attacker can be remote and does not need privileges or prior authentication. User interaction is required, specifically visiting the crafted page.
3
What is the impact of successful exploitation?
A successful exploit can execute arbitrary code inside the Chromium sandbox. The provided information does not indicate that this vulnerability alone enables a sandbox escape.