DEBIAN-CVE-2026-121156: Buffer Overflow
Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Debian systems using the chromium package are affected if they run a version of Google Chrome prior to 157.0.8103.38. The issue is reachable remotely through crafted HTML content.
What does an attacker need to exploit it?
The attacker does not need privileges or prior authentication, but a user must interact with a crafted HTML page. Successful exploitation could allow arbitrary code execution outside the browser sandbox.
Is a default browser configuration affected?
The available data does not identify any non-default feature, setting, or extension requirement. The vulnerability is described as being triggered by crafted HTML content.
How can I determine whether a system may be affected?
Check whether Debian's chromium package is installed and determine the underlying Chromium/Chrome version. Versions prior to 157.0.8103.38 may be affected according to the provided vulnerability description.