DEBIAN-CVE-2026-121219: Integer Overflow
Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Affected Software
Event History
Frequently Asked Questions
What must an attacker achieve before this issue can be used to escape the sandbox?
The attacker must first compromise the Chromium renderer process. The vulnerability can then potentially be used through a crafted HTML page to execute arbitrary code outside the sandbox.
Is user interaction required?
Yes. The supplied CVSS vector includes UI:R, indicating that user interaction is required. The data does not specify the exact interaction needed.
Which Debian software is identified as affected, and what version boundary is provided?
The affected software is Debian's chromium package. The issue affects Google Chrome versions before 157.0.8103.38; no Debian package version containing the fix is provided.