DEBIAN-CVE-2026-121185: Use After Free
Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Debian's chromium package are exposed when using a version prior to 157.0.8103.38. Exploitation requires the user to interact with a crafted HTML page.
What does an attacker need to exploit it?
The attacker can be remote and does not need prior privileges, but must use social engineering to get a user to interact with a crafted HTML page. Successful exploitation can execute arbitrary code outside the browser sandbox.
Is there a fixed version identified in the available information?
Yes. The issue affects Google Chrome versions prior to 157.0.8103.38; the provided data does not state the corresponding Debian chromium package version.