DEBIAN-CVE-2026-121179: Use After Free
Published Nov 3, 2026
·Updated
Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker must deliver a crafted HTML page and require user interaction. Exploitation is remote and does not require attacker privileges.
2
What is the expected impact if exploitation succeeds?
A successful exploit can execute arbitrary code inside the browser sandbox. The reported vector rates confidentiality, integrity, and availability impact as high.
3
Which Debian deployment should be prioritized for review?
The affected software identified in the available data is Debian's chromium package. Systems where users browse untrusted or externally supplied web content should be prioritized.