DEBIAN-CVE-2026-126919: Use After Free
Published Nov 11, 2026
·Updated
Use after free in BrowserTag in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
3 affected components
debian/chromium*
debian/chromium*
debian/chromium*
Event History
Nov 11, 2026
CVE Published
via OSV·11:17 PM
Data Sourced
via OSV·11:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
The attacker must cause a user to load a crafted HTML page. Successful exploitation allows arbitrary code execution inside the browser sandbox.
2
Which Chrome versions are affected?
Google Chrome versions prior to 157.0.8103.78 are affected. The provided data identifies the Debian package as chromium but does not specify Debian package versions or fixed package versions.
3
Is this a sandbox escape?
No. The stated impact is arbitrary code execution inside the sandbox; the provided information does not indicate execution outside the sandbox or a sandbox escape.