DEBIAN-CVE-2026-121228: High severity debian/chromium vulnerability
Published Nov 3, 2026
·Updated
Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 3, 2026
CVE Published
via OSV·09:17 PM
Data Sourced
via OSV·09:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker needs to get a user to interact with a crafted HTML page. The attack can be delivered remotely and does not require attacker privileges.
2
Is the impact limited to the browser sandbox?
The reported arbitrary code execution occurs inside the sandbox. The provided information does not indicate that this vulnerability alone enables an escape from the sandbox.
3
Which Chromium versions are affected?
Google Chrome versions prior to 157.0.8103.38 are described as affected. The provided data identifies Debian's chromium package but does not provide the fixed Debian package version.