DEBIAN-CVE-2026-121227: Debian/chromium vulnerability
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
The issue affects Debian Chromium installations running a version prior to 157.0.8103.38. Exploitation is relevant after an attacker has already compromised the browser renderer process.
What does an attacker need to exploit this vulnerability?
The attacker needs renderer-process compromise and can then use a crafted HTML page to trigger the issue. The described impact is reading memory outside the browser sandbox.
Is this exploitable from a normal remote web page alone?
The available information does not describe this as a standalone web-page compromise. It specifically requires the attacker to have compromised the renderer process first.