DEBIAN-CVE-2026-126847: High severity debian/chromium vulnerability
Published Nov 11, 2026
·Updated
Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 11, 2026
CVE Published
via OSV·11:17 PM
Data Sourced
via OSV·11:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker needs to cause Chromium to render a crafted HTML page. Exploitation is remote and results in arbitrary code execution inside the browser sandbox.
2
Is this a sandbox escape?
No. The available information states that code execution occurs inside the sandbox; it does not indicate that the attacker can escape the sandbox or gain host-level code execution.
3
Which Chromium versions are affected?
Google Chrome versions prior to 157.0.8103.78 are described as affected. The provided data does not identify the specific Debian Chromium package versions that contain the fix.