DEBIAN-CVE-2026-126885: Use After Free
Published Nov 11, 2026
·Updated
Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 11, 2026
CVE Published
via OSV·11:17 PM
Data Sourced
via OSV·11:17 PM
DescriptionAffected Software
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
An attacker must cause a user to load a crafted HTML page. Successful exploitation can execute arbitrary code outside Chrome's sandbox.
2
Which deployments should be prioritized for remediation?
Debian systems using Chromium versions earlier than 157.0.8103.78 are affected. Systems where users browse untrusted websites should be prioritized because exploitation is triggered through crafted web content.
3
How can I determine whether a system is affected?
Check the installed Debian Chromium version. Versions prior to 157.0.8103.78 are affected; version information is not otherwise provided in the available data.