DEBIAN-CVE-2026-126864: Use After Free
Published Nov 11, 2026
·Updated
Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 11, 2026
CVE Published
via OSV·11:17 PM
Data Sourced
via OSV·11:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker needs to cause a user to load a crafted HTML page in an affected Chromium browser. The reported impact is arbitrary code execution inside the browser sandbox.
2
Which Debian software is identified as affected?
The affected software listed is Debian's chromium package. The issue applies to Google Chrome versions prior to 157.0.8103.78, but no Debian package version is provided.
3
Is this a sandbox escape?
No. The available information states that code execution occurs inside the sandbox; it does not claim that the attacker can escape the sandbox or execute code on the underlying system.