DEBIAN-CVE-2026-126846: Use After Free
Published Nov 11, 2026
·Updated
Use after free in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Affected Software
4 affected components
debian/chromium*
debian/chromium*
debian/chromium*
debian/libskia*
Event History
Nov 11, 2026
CVE Published
via OSV·11:17 PM
Data Sourced
via OSV·11:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Who is exposed to this issue?
The provided information identifies Google Chrome on Android prior to 157.0.8103.78 as affected. Although the listed software is debian/chromium, the data does not state which Debian Chromium versions or configurations are affected.
2
What does an attacker need to exploit it?
An attacker needs to induce the target to process a crafted HTML page remotely. Successful exploitation can result in arbitrary code execution outside the sandbox.