DEBIAN-CVE-2026-121237: Debian/chromium vulnerability

Published Nov 3, 2026

Updated

Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

3 affected components

debian/chromium*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 157.0.8103.38

Event History

Nov 3, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to convince a user to open a crafted HTML page. The issue is remotely exploitable through browser content and relies on social engineering.

Which systems should be prioritized for review?

Prioritize Debian systems running the chromium package, particularly where users browse untrusted websites or may open attacker-supplied HTML content. The upstream issue affects Google Chrome versions prior to 157.0.8103.38.