DEBIAN-CVE-2026-121211: Use After Free
Published Nov 3, 2026
·Updated
Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionAffected Software
Frequently Asked Questions
1
What must an attacker achieve before this flaw can be exploited?
The attacker must first compromise the Chromium renderer process. Exploitation also relies on social engineering to get the target to use a crafted Chrome extension.
2
What is the potential impact after successful exploitation?
A successful attack can allow arbitrary code execution outside Chromium's sandbox.
3
Which Debian software package is identified as affected?
The affected software identified in the provided data is debian/chromium.