DEBIAN-CVE-2026-126848: Debian/chromium vulnerability
Published Nov 11, 2026
·Updated
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 11, 2026
CVE Published
via OSV·11:17 PM
Data Sourced
via OSV·11:17 PM
DescriptionAffected Software
Frequently Asked Questions
1
What level of access does an attacker need before exploiting this issue?
The attacker must first compromise the Chromium renderer process. The vulnerability can then be triggered with a crafted HTML page to read memory outside the sandbox.
2
What impact does successful exploitation have?
Successful exploitation allows reading memory outside the renderer sandbox. The issue is described as an uninitialized resource vulnerability in Skia.
3
Which Debian software is identified as affected?
The affected software listed is Debian's chromium package. The description states that Google Chrome versions prior to 157.0.8103.78 are vulnerable, but no Debian package version is provided.