DEBIAN-CVE-2026-126871: Medium severity debian/chromium vulnerability
Published Nov 11, 2026
·Updated
Out of bounds read in Skia in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
4 affected components
debian/chromium*
debian/chromium*
debian/chromium*
debian/libskia*
Event History
Nov 11, 2026
CVE Published
via OSV·11:17 PM
Data Sourced
via OSV·11:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Who is exposed to this issue?
Users of Chromium on Debian are exposed when they visit a crafted HTML page. The issue is remotely exploitable and does not require the attacker to have local access.
2
What can an attacker achieve?
A remote attacker can cause an out-of-bounds read in Skia and read memory outside the browser sandbox.
3
What version information is available for remediation?
The issue affects Google Chrome on Mac before 157.0.8103.78, but the provided data does not identify the fixed Debian Chromium version. Check Debian's security tracker entry for package-specific status.