DEBIAN-CVE-2026-121183: High severity debian/chromium vulnerability
Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Affected Software
Event History
Frequently Asked Questions
What does an attacker need before this can be exploited?
The attacker must first compromise the Chromium renderer process and then use a crafted HTML page. The vector is network-based, but exploitation also requires user interaction.
Who should prioritize triage?
Organizations running Debian's chromium package should prioritize systems where users may interact with untrusted web content, particularly if renderer compromise would be a meaningful stepping stone to escaping the browser sandbox.
Can the affected or fixed Debian package version be determined from this information?
No. The supplied data identifies an upstream Google Chrome version threshold, but does not provide Debian chromium package versions or a Debian-specific fixed-version mapping.