DEBIAN-CVE-2026-121159: Debian/chromium vulnerability

Published Nov 3, 2026

Updated

Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

Affected Software

3 affected components

debian/chromium*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 157.0.8103.38

Event History

Nov 3, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionAffected Software

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must induce the target to interact with a crafted HTML page through social engineering. The issue is described as remotely exploitable and does not indicate that the attacker needs local system access.

Which versions should be checked for exposure?

The affected software is listed as Debian Chromium. The available data identifies Google Chrome versions before 157.0.8103.38 as affected, but it does not provide the corresponding Debian Chromium package versions or a Debian fixed-version mapping.