DEBIAN-CVE-2026-121188: Use After Free
Published Nov 3, 2026
·Updated
Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What would an attacker need to exploit this issue?
An attacker would need to get a user to load a crafted HTML page. The issue is remotely reachable and requires no privileges, but user interaction is required.
2
What is the impact if exploitation succeeds?
Successful exploitation can allow arbitrary code execution inside the Chromium sandbox, with high impact to confidentiality, integrity, and availability.
3
Which Chromium versions are affected?
Google Chrome versions prior to 157.0.8103.38 are affected according to the available information. The provided data does not identify the specific Debian chromium package versions containing the fix.