DEBIAN-CVE-2026-121256: High severity debian/chromium vulnerability

Published Nov 3, 2026

Updated

Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

3 affected components

debian/chromium*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 157.0.8103.38

Event History

Nov 3, 2026

CVE Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker achieve before this issue can be exploited?

The attacker must first compromise the Chromium renderer process. Exploitation also requires user interaction with a crafted HTML page.

Which deployments are identified by this record?

The record identifies Debian's chromium package. It does not provide information about other distributions, Chrome builds, or configuration-specific exposure.