DEBIAN-CVE-2026-126884: Medium severity debian/chromium vulnerability
Published Nov 11, 2026
·Updated
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
4 affected components
debian/chromium*
debian/chromium*
debian/chromium*
debian/libskia*
Event History
Nov 11, 2026
CVE Published
via OSV·11:17 PM
Data Sourced
via OSV·11:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker needs to cause a user to process a crafted HTML page remotely. The issue is described as allowing memory reads outside the sandbox.
2
Which Debian software should be investigated?
The affected software identified in the available data is Debian's chromium package. The description applies to Google Chrome versions prior to 157.0.8103.78, but no Debian package version or fixed Debian version is provided.