DEBIAN-CVE-2026-121166: Debian/chromium vulnerability
Published Nov 3, 2026
·Updated
Type confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionAffected Software
Frequently Asked Questions
1
What systems are realistically exposed?
Systems running Debian Chromium are exposed when they process a crafted PDF file. The issue is in PDFium, the PDF component used by Chromium.
2
What does an attacker need to exploit this issue?
The attacker needs to cause Chromium to process a crafted PDF. The available data does not describe any additional authentication, local-access, or user-interaction requirements.
3
Does the reported impact include a sandbox escape?
No sandbox escape is stated. The reported arbitrary code execution is inside the sandbox.
4
What version boundary is available?
The issue affects Google Chrome versions prior to 157.0.8103.38. No Debian Chromium package version or fixed-package version is provided.