DEBIAN-CVE-2026-121217: Use After Free
Published Nov 3, 2026
·Updated
Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionAffected Software
Frequently Asked Questions
1
What level of network access does an attacker need?
The attacker must be adjacent to the target and able to send crafted network traffic. The described code execution occurs inside the Chrome sandbox.
2
Which Chrome versions are affected?
Google Chrome versions prior to 157.0.8103.38 are described as affected. The provided data does not identify the corresponding fixed Debian chromium package version.
3
Is this issue remotely exploitable over arbitrary Internet connections?
The available information specifies an adjacent attacker, rather than a generally remote Internet-based attacker. It does not provide further details about the required network topology or protocol conditions.