DEBIAN-CVE-2026-126901: Use After Free
Published Nov 11, 2026
·Updated
Use after free in PDF in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 11, 2026
CVE Published
via OSV·11:17 PM
Data Sourced
via OSV·11:17 PM
DescriptionAffected Software
Frequently Asked Questions
1
What would an attacker need to exploit this issue?
An attacker would need to persuade a user to load a crafted HTML page in Chromium. Successful exploitation allows arbitrary code execution inside the browser sandbox.
2
Which installations should be prioritized for remediation?
Debian systems running Chromium versions earlier than 157.0.8103.78 should be prioritized, particularly where users browse untrusted websites or open web content from untrusted sources.
3
Does this vulnerability allow code execution outside the browser sandbox?
The available information states that arbitrary code execution occurs inside the sandbox. It does not indicate that the vulnerability alone escapes the Chromium sandbox.