DEBIAN-CVE-2026-126866: High severity debian/chromium vulnerability
Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must use social engineering to persuade a target to interact with or install a crafted Chrome extension. Exploitation then allows arbitrary code execution inside the browser sandbox.
Is this limited to a particular extension or deployment configuration?
The available information identifies the affected component only as Chrome Extensions and does not name a specific extension or configuration. Systems running Chromium versions prior to 157.0.8103.78 are in scope based on the advisory.
How can I determine whether a system is affected?
Check the installed Debian Chromium version. The issue affects versions prior to 157.0.8103.78; the provided data does not specify the Debian package version containing the fix.