DEBIAN-CVE-2026-126853: Low severity debian/chromium vulnerability
Published Nov 11, 2026
·Updated
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
4 affected components
debian/chromium*
debian/chromium*
debian/chromium*
debian/libskia*
Event History
Nov 11, 2026
CVE Published
via OSV·11:17 PM
Data Sourced
via OSV·11:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What must an attacker achieve before exploiting this issue?
The attacker must already have compromised the browser renderer process. They can then use a crafted HTML page to trigger the vulnerability.
2
What is the security impact after successful exploitation?
A successful exploit allows memory to be read outside the browser sandbox. This can weaken the isolation that normally restricts a compromised renderer process.
3
Which browser versions are identified as vulnerable?
The issue is identified in Google Chrome versions before 157.0.8103.78. The provided data does not specify the corresponding Debian Chromium package version.