DEBIAN-CVE-2026-121140: High severity debian/chromium vulnerability
Published Nov 3, 2026
·Updated
Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Does an attacker need local access or an authenticated account?
No privileges are required, and the attack vector is network-based. However, the attacker must already have compromised the Chromium renderer process.
2
Is user interaction required for exploitation?
Yes. The CVSS vector indicates user interaction is required, with exploitation involving a crafted HTML page.