{"grype_matches":[{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-125350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125350","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-12","epss":0.00962,"percentile":0.62112}],"risk":85.57500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125350","description":"Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-125350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-12","epss":0.00962,"percentile":0.62112}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/582442907","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-125350"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125350","description":"Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125350","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-12","epss":0.00962,"percentile":0.62112}],"risk":85.57500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125350","description":"Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-125350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-12","epss":0.00962,"percentile":0.62112}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/582442907","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-125350"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125350","description":"Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125350","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-12","epss":0.00962,"percentile":0.62112}],"risk":85.57500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125350","description":"Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-125350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-12","epss":0.00962,"percentile":0.62112}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/582442907","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-125350"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125350","description":"Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125350","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-12","epss":0.00962,"percentile":0.62112}],"risk":85.57500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125350","description":"Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-125350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-12","epss":0.00962,"percentile":0.62112}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/582442907","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-125350"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125350","description":"Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125350","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-12","epss":0.00962,"percentile":0.62112}],"risk":85.57500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125350","description":"Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-125350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-12","epss":0.00962,"percentile":0.62112}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/582442907","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-125350"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125350","description":"Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"742d787e0b164278","cpes":["cpe:2.3:a:libgnutls30t64:libgnutls30t64:3.8.9-3\\+deb13u4:*:*:*:*:*:*:*"],"name":"libgnutls30t64","purl":"pkg:deb/debian/libgnutls30t64@3.8.9-3%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=gnutls28","type":"deb","version":"3.8.9-3+deb13u4","language":"","licenses":["sha256:a07e99815cf1998f1dabbc21fe199460bfa09b85ead0d56b49a32cac3d1791b5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30t64/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgnutls30t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgnutls30t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-3389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gnutls28","version":"3.8.9-3+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2011-3389","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-11-12","epss":0.73327,"percentile":0.99469}],"risk":3.66635,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."},"relatedVulnerabilities":[{"id":"CVE-2011-3389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-11-12","epss":0.73327,"percentile":0.99469}],"urls":["http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/","http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx","http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx","http://curl.haxx.se/docs/adv_20120124B.html","http://downloads.asterisk.org/pub/security/AST-2016-001.html","http://ekoparty.org/2011/juliano-rizzo.php","http://eprint.iacr.org/2004/111","http://eprint.iacr.org/2006/136","http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html","http://isc.sans.edu/diary/SSL+TLS+part+3+/11635","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html","http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html","http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2012/May/msg00001.html","http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://marc.info/?l=bugtraq&m=132750579901589&w=2","http://marc.info/?l=bugtraq&m=132872385320240&w=2","http://marc.info/?l=bugtraq&m=133365109612558&w=2","http://marc.info/?l=bugtraq&m=133728004526190&w=2","http://marc.info/?l=bugtraq&m=134254866602253&w=2","http://marc.info/?l=bugtraq&m=134254957702612&w=2","http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue","http://osvdb.org/74829","http://rhn.redhat.com/errata/RHSA-2012-0508.html","http://rhn.redhat.com/errata/RHSA-2013-1455.html","http://secunia.com/advisories/45791","http://secunia.com/advisories/47998","http://secunia.com/advisories/48256","http://secunia.com/advisories/48692","http://secunia.com/advisories/48915","http://secunia.com/advisories/48948","http://secunia.com/advisories/49198","http://secunia.com/advisories/55322","http://secunia.com/advisories/55350","http://secunia.com/advisories/55351","http://security.gentoo.org/glsa/glsa-201203-02.xml","http://security.gentoo.org/glsa/glsa-201406-32.xml","http://support.apple.com/kb/HT4999","http://support.apple.com/kb/HT5001","http://support.apple.com/kb/HT5130","http://support.apple.com/kb/HT5281","http://support.apple.com/kb/HT5501","http://support.apple.com/kb/HT6150","http://technet.microsoft.com/security/advisory/2588513","http://vnhacker.blogspot.com/2011/09/beast.html","http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf","http://www.debian.org/security/2012/dsa-2398","http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html","http://www.ibm.com/developerworks/java/jdk/alerts/","http://www.imperialviolet.org/2011/09/23/chromeandbeast.html","http://www.insecure.cl/Beast-SSL.rar","http://www.kb.cert.org/vuls/id/864643","http://www.mandriva.com/security/advisories?name=MDVSA-2012:058","http://www.opera.com/docs/changelogs/mac/1151/","http://www.opera.com/docs/changelogs/mac/1160/","http://www.opera.com/docs/changelogs/unix/1151/","http://www.opera.com/docs/changelogs/unix/1160/","http://www.opera.com/docs/changelogs/windows/1151/","http://www.opera.com/docs/changelogs/windows/1160/","http://www.opera.com/support/kb/view/1004/","http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html","http://www.redhat.com/support/errata/RHSA-2011-1384.html","http://www.redhat.com/support/errata/RHSA-2012-0006.html","http://www.securityfocus.com/bid/49388","http://www.securityfocus.com/bid/49778","http://www.securitytracker.com/id/1029190","http://www.securitytracker.com/id?1025997","http://www.securitytracker.com/id?1026103","http://www.securitytracker.com/id?1026704","http://www.ubuntu.com/usn/USN-1263-1","http://www.us-cert.gov/cas/techalerts/TA12-010A.html","https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail","https://bugzilla.novell.com/show_bug.cgi?id=719047","https://bugzilla.redhat.com/show_bug.cgi?id=737506","https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006","https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862","https://hermes.opensuse.org/messages/13154861","https://hermes.opensuse.org/messages/13155432","https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34980","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-34980","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34980","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34980","date":"2026-11-12","epss":0.01652,"percentile":0.76886}],"risk":1.239,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-34980","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches."},"relatedVulnerabilities":[{"id":"CVE-2026-34980","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34980","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34980","date":"2026-11-12","epss":0.01652,"percentile":0.76886}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34980","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"3283c74353a6fd98","cpes":["cpe:2.3:a:xdg-utils:xdg-utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg-utils:xdg_utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg_utils:xdg-utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg_utils:xdg_utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg:xdg-utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg:xdg_utils:1.2.1-2:*:*:*:*:*:*:*"],"name":"xdg-utils","purl":"pkg:deb/debian/xdg-utils@1.2.1-2?arch=all&distro=debian-13.7","type":"deb","version":"1.2.1-2","language":"","licenses":["Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xdg-utils/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/xdg-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xdg-utils.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/xdg-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xdg-utils.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/xdg-utils.list"},{"path":"/var/lib/dpkg/info/xdg-utils.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/xdg-utils.postinst"},{"path":"/var/lib/dpkg/info/xdg-utils.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/xdg-utils.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-27748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"xdg-utils","version":"1.2.1-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2020-27748","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-27748","cwe":"CWE-201","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-27748","date":"2026-11-12","epss":0.01436,"percentile":0.73505}],"risk":0.8256999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-27748","description":"A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird."},"relatedVulnerabilities":[{"id":"CVE-2020-27748","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-27748","cwe":"CWE-201","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-27748","date":"2026-11-12","epss":0.01436,"percentile":0.73505}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1899769","https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-27748","description":"A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird."}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.68625,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.68625,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.68625,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.68625,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"56182221a173d843","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.7.0-3\\+deb13u3:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=arm64&distro=debian-13.7&upstream=tiff","type":"deb","version":"4.7.0-3+deb13u3","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libtiff6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-52490","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"tiff","version":"4.7.0-3+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-52490","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52490","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52490","date":"2026-11-12","epss":0.00726,"percentile":0.54607}],"risk":0.68244,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-52490","description":"An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c"},"relatedVulnerabilities":[{"id":"CVE-2026-52490","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52490","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52490","date":"2026-11-12","epss":0.00726,"percentile":0.54607}],"urls":["https://gist.github.com/okyfh/122c2d72e991a78c8af80a3af3be8671","https://gitlab.com/libtiff/libtiff/-/work_items/846"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52490","description":"An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c"}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.6749999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.6749999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.6749999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.6749999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.58425,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.58425,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.58425,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.58425,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.5482499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.5482499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.5482499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.5482499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"3a3de47e33e1d8aa","cpes":["cpe:2.3:a:libcairo-gobject2:libcairo-gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo-gobject2:libcairo_gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo-gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo_gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo-gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo_gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*"],"name":"libcairo-gobject2","purl":"pkg:deb/debian/libcairo-gobject2@1.18.4-1%2Bb1?arch=arm64&distro=debian-13.7&upstream=cairo%401.18.4-1","type":"deb","version":"1.18.4-1+b1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo-gobject2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libcairo-gobject2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo-gobject2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libcairo-gobject2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo","version":"1.18.4-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cairo","version":"1.18.4-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-11-12","epss":0.01824,"percentile":0.79102}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-11-12","epss":0.01824,"percentile":0.79102}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"0522bb7de4d00cc0","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.4-1\\+b1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/debian/libcairo2@1.18.4-1%2Bb1?arch=arm64&distro=debian-13.7&upstream=cairo%401.18.4-1","type":"deb","version":"1.18.4-1+b1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libcairo2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo","version":"1.18.4-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cairo","version":"1.18.4-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-11-12","epss":0.01824,"percentile":0.79102}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-11-12","epss":0.01824,"percentile":0.79102}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"25e48be699bee41c","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=arm64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libxml2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-74860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-74860","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74860","cwe":"CWE-763","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-74860","date":"2026-11-12","epss":0.00658,"percentile":0.51981}],"risk":0.5264000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-74860","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings."},"relatedVulnerabilities":[{"id":"CVE-2026-74860","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74860","cwe":"CWE-763","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-74860","date":"2026-11-12","epss":0.00658,"percentile":0.51981}],"urls":["https://access.redhat.com/errata/RHSA-2026:64463","https://access.redhat.com/errata/RHSA-2026:71585","https://access.redhat.com/errata/RHSA-2026:71586","https://access.redhat.com/errata/RHSA-2026:71641","https://access.redhat.com/errata/RHSA-2026:72470","https://access.redhat.com/errata/RHSA-2026:72475","https://access.redhat.com/errata/RHSA-2026:72476","https://access.redhat.com/errata/RHSA-2026:79357","https://access.redhat.com/errata/RHSA-2026:82939","https://access.redhat.com/errata/RHSA-2026:89750","https://access.redhat.com/errata/RHSA-2026:89759","https://access.redhat.com/errata/RHSA-2026:90309","https://access.redhat.com/errata/RHSA-2026:91202","https://access.redhat.com/errata/RHSA-2026:91204","https://access.redhat.com/errata/RHSA-2026:91206","https://access.redhat.com/errata/RHSA-2026:91207","https://access.redhat.com/errata/RHSA-2026:91217","https://access.redhat.com/errata/RHSA-2026:91218","https://access.redhat.com/errata/RHSA-2026:91219","https://access.redhat.com/errata/RHSA-2026:91224","https://access.redhat.com/errata/RHSA-2026:91232","https://access.redhat.com/errata/RHSA-2026:91233","https://access.redhat.com/errata/RHSA-2026:91234","https://access.redhat.com/errata/RHSA-2026:91235","https://access.redhat.com/errata/RHSA-2026:91236","https://access.redhat.com/errata/RHSA-2026:91237","https://access.redhat.com/errata/RHSA-2026:91238","https://access.redhat.com/errata/RHSA-2026:91241","https://access.redhat.com/errata/RHSA-2026:91242","https://access.redhat.com/errata/RHSA-2026:91243","https://access.redhat.com/errata/RHSA-2026:91244","https://access.redhat.com/errata/RHSA-2026:91245","https://access.redhat.com/errata/RHSA-2026:91246","https://access.redhat.com/errata/RHSA-2026:91248","https://access.redhat.com/errata/RHSA-2026:91249","https://access.redhat.com/errata/RHSA-2026:92352","https://access.redhat.com/errata/RHSA-2026:92589","https://access.redhat.com/errata/RHSA-2026:93463","https://access.redhat.com/errata/RHSA-2026:93473","https://access.redhat.com/errata/RHSA-2026:93791","https://access.redhat.com/errata/RHSA-2026:94459","https://access.redhat.com/errata/RHSA-2026:94468","https://access.redhat.com/errata/RHSA-2026:94474","https://access.redhat.com/errata/RHSA-2026:94476","https://access.redhat.com/errata/RHSA-2026:98468","https://access.redhat.com/errata/RHSA-2026:98572","https://access.redhat.com/security/cve/CVE-2026-74860","https://bugzilla.redhat.com/show_bug.cgi?id=2529697"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74860","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-6988","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-11-12","epss":0.01724,"percentile":0.77853}],"risk":0.5172,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-6988","description":"An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress."},"relatedVulnerabilities":[{"id":"CVE-2019-6988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-11-12","epss":0.01724,"percentile":0.77853}],"urls":["http://www.securityfocus.com/bid/106785","https://github.com/uclouvain/openjpeg/issues/1178"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6988","description":"An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress."}]},{"artifact":{"id":"3283c74353a6fd98","cpes":["cpe:2.3:a:xdg-utils:xdg-utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg-utils:xdg_utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg_utils:xdg-utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg_utils:xdg_utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg:xdg-utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg:xdg_utils:1.2.1-2:*:*:*:*:*:*:*"],"name":"xdg-utils","purl":"pkg:deb/debian/xdg-utils@1.2.1-2?arch=all&distro=debian-13.7","type":"deb","version":"1.2.1-2","language":"","licenses":["Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xdg-utils/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/xdg-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xdg-utils.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/xdg-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xdg-utils.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/xdg-utils.list"},{"path":"/var/lib/dpkg/info/xdg-utils.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/xdg-utils.postinst"},{"path":"/var/lib/dpkg/info/xdg-utils.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/xdg-utils.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-4055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"xdg-utils","version":"1.2.1-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2022-4055","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4055","cwe":"CWE-146","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2022-4055","date":"2026-11-12","epss":0.00692,"percentile":0.53358}],"risk":0.51554,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-4055","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked."},"relatedVulnerabilities":[{"id":"CVE-2022-4055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4055","cwe":"CWE-146","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2022-4055","date":"2026-11-12","epss":0.00692,"percentile":0.53358}],"urls":["https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/205#note_1494267"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4055","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked."}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.47850000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"fb1cc646c716a53f","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.40.1-6%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=perl","type":"deb","version":"5.40.1-6+deb13u1","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"perl","version":"5.40.1-6+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"risk":0.47250000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.  Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.  Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121156","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121156","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121156","date":"2026-11-12","epss":0.00482,"percentile":0.42066}],"risk":0.44826,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121156","description":"Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121156","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121156","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121156","date":"2026-11-12","epss":0.00482,"percentile":0.42066}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567735302"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121156","description":"Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121156","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121156","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121156","date":"2026-11-12","epss":0.00482,"percentile":0.42066}],"risk":0.44826,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121156","description":"Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121156","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121156","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121156","date":"2026-11-12","epss":0.00482,"percentile":0.42066}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567735302"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121156","description":"Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121156","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121156","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121156","date":"2026-11-12","epss":0.00482,"percentile":0.42066}],"risk":0.44826,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121156","description":"Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121156","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121156","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121156","date":"2026-11-12","epss":0.00482,"percentile":0.42066}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567735302"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121156","description":"Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121156","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121156","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121156","date":"2026-11-12","epss":0.00482,"percentile":0.42066}],"risk":0.44826,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121156","description":"Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121156","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121156","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121156","date":"2026-11-12","epss":0.00482,"percentile":0.42066}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567735302"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121156","description":"Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121156","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121156","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121156","date":"2026-11-12","epss":0.00482,"percentile":0.42066}],"risk":0.44826,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121156","description":"Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121156","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121156","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121156","date":"2026-11-12","epss":0.00482,"percentile":0.42066}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567735302"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121156","description":"Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.42665,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.42665,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.42665,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.42665,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121037","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121037","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121037","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121037","date":"2026-11-12","epss":0.00453,"percentile":0.39803}],"risk":0.42128999999999994,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121037","description":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121037","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121037","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121037","date":"2026-11-12","epss":0.00453,"percentile":0.39803}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569415790"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121037","description":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121037","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121037","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121037","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121037","date":"2026-11-12","epss":0.00453,"percentile":0.39803}],"risk":0.42128999999999994,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121037","description":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121037","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121037","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121037","date":"2026-11-12","epss":0.00453,"percentile":0.39803}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569415790"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121037","description":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121037","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121037","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121037","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121037","date":"2026-11-12","epss":0.00453,"percentile":0.39803}],"risk":0.42128999999999994,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121037","description":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121037","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121037","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121037","date":"2026-11-12","epss":0.00453,"percentile":0.39803}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569415790"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121037","description":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121037","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121037","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121037","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121037","date":"2026-11-12","epss":0.00453,"percentile":0.39803}],"risk":0.42128999999999994,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121037","description":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121037","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121037","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121037","date":"2026-11-12","epss":0.00453,"percentile":0.39803}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569415790"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121037","description":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121037","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121037","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121037","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121037","date":"2026-11-12","epss":0.00453,"percentile":0.39803}],"risk":0.42128999999999994,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121037","description":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121037","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121037","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121037","date":"2026-11-12","epss":0.00453,"percentile":0.39803}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569415790"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121037","description":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121086","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121086","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121086","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121086","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121086","description":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121086","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121086","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121086","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569674218"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121086","description":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121249","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121249","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121249","cwe":"CWE-121","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121249","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121249","description":"Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121249","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121249","cwe":"CWE-121","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121249","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574752676"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121249","description":"Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121086","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121086","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121086","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121086","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121086","description":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121086","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121086","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121086","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569674218"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121086","description":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121249","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121249","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121249","cwe":"CWE-121","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121249","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121249","description":"Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121249","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121249","cwe":"CWE-121","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121249","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574752676"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121249","description":"Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121086","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121086","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121086","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121086","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121086","description":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121086","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121086","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121086","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569674218"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121086","description":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121249","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121249","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121249","cwe":"CWE-121","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121249","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121249","description":"Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121249","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121249","cwe":"CWE-121","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121249","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574752676"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121249","description":"Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121086","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121086","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121086","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121086","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121086","description":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121086","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121086","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121086","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569674218"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121086","description":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121249","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121249","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121249","cwe":"CWE-121","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121249","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121249","description":"Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121249","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121249","cwe":"CWE-121","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121249","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574752676"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121249","description":"Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121086","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121086","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121086","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121086","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121086","description":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121086","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121086","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121086","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569674218"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121086","description":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121249","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121249","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121249","cwe":"CWE-121","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121249","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121249","description":"Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121249","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121249","cwe":"CWE-121","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121249","date":"2026-11-12","epss":0.00449,"percentile":0.39523}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574752676"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121249","description":"Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121247","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121247","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121247","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121247","date":"2026-11-12","epss":0.00449,"percentile":0.39522}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121247","description":"Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121247","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121247","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121247","date":"2026-11-12","epss":0.00449,"percentile":0.39522}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569161611"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121247","description":"Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121247","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121247","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121247","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121247","date":"2026-11-12","epss":0.00449,"percentile":0.39522}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121247","description":"Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121247","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121247","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121247","date":"2026-11-12","epss":0.00449,"percentile":0.39522}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569161611"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121247","description":"Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121247","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121247","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121247","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121247","date":"2026-11-12","epss":0.00449,"percentile":0.39522}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121247","description":"Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121247","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121247","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121247","date":"2026-11-12","epss":0.00449,"percentile":0.39522}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569161611"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121247","description":"Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121247","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121247","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121247","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121247","date":"2026-11-12","epss":0.00449,"percentile":0.39522}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121247","description":"Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121247","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121247","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121247","date":"2026-11-12","epss":0.00449,"percentile":0.39522}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569161611"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121247","description":"Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121247","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121247","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121247","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121247","date":"2026-11-12","epss":0.00449,"percentile":0.39522}],"risk":0.41757,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121247","description":"Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121247","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121247","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121247","date":"2026-11-12","epss":0.00449,"percentile":0.39522}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569161611"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121247","description":"Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121035","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121035","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121035","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121035","date":"2026-11-12","epss":0.00443,"percentile":0.39004}],"risk":0.4119899999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121035","description":"Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121035","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121035","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121035","date":"2026-11-12","epss":0.00443,"percentile":0.39004}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567216197"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121035","description":"Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121035","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121035","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121035","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121035","date":"2026-11-12","epss":0.00443,"percentile":0.39004}],"risk":0.4119899999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121035","description":"Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121035","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121035","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121035","date":"2026-11-12","epss":0.00443,"percentile":0.39004}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567216197"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121035","description":"Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121035","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121035","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121035","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121035","date":"2026-11-12","epss":0.00443,"percentile":0.39004}],"risk":0.4119899999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121035","description":"Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121035","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121035","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121035","date":"2026-11-12","epss":0.00443,"percentile":0.39004}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567216197"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121035","description":"Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121035","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121035","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121035","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121035","date":"2026-11-12","epss":0.00443,"percentile":0.39004}],"risk":0.4119899999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121035","description":"Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121035","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121035","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121035","date":"2026-11-12","epss":0.00443,"percentile":0.39004}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567216197"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121035","description":"Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121035","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121035","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121035","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121035","date":"2026-11-12","epss":0.00443,"percentile":0.39004}],"risk":0.4119899999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121035","description":"Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121035","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121035","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121035","date":"2026-11-12","epss":0.00443,"percentile":0.39004}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567216197"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121035","description":"Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-125347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125347","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125347","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125347","date":"2026-11-12","epss":0.0044,"percentile":0.38751}],"risk":0.4092,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125347","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125347","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125347","date":"2026-11-12","epss":0.0044,"percentile":0.38751}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/561996724"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125347","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125347","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125347","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125347","date":"2026-11-12","epss":0.0044,"percentile":0.38751}],"risk":0.4092,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125347","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125347","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125347","date":"2026-11-12","epss":0.0044,"percentile":0.38751}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/561996724"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125347","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125347","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125347","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125347","date":"2026-11-12","epss":0.0044,"percentile":0.38751}],"risk":0.4092,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125347","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125347","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125347","date":"2026-11-12","epss":0.0044,"percentile":0.38751}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/561996724"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125347","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125347","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125347","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125347","date":"2026-11-12","epss":0.0044,"percentile":0.38751}],"risk":0.4092,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125347","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125347","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125347","date":"2026-11-12","epss":0.0044,"percentile":0.38751}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/561996724"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125347","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125347","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125347","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125347","date":"2026-11-12","epss":0.0044,"percentile":0.38751}],"risk":0.4092,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125347","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125347","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125347","date":"2026-11-12","epss":0.0044,"percentile":0.38751}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/561996724"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125347","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-125344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125344","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125344","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125344","date":"2026-11-12","epss":0.00496,"percentile":0.43078}],"risk":0.40424000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125344","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125344","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125344","date":"2026-11-12","epss":0.00496,"percentile":0.43078}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/568893995"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125344","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125344","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125344","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125344","date":"2026-11-12","epss":0.00496,"percentile":0.43078}],"risk":0.40424000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125344","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125344","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125344","date":"2026-11-12","epss":0.00496,"percentile":0.43078}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/568893995"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125344","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125344","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125344","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125344","date":"2026-11-12","epss":0.00496,"percentile":0.43078}],"risk":0.40424000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125344","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125344","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125344","date":"2026-11-12","epss":0.00496,"percentile":0.43078}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/568893995"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125344","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125344","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125344","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125344","date":"2026-11-12","epss":0.00496,"percentile":0.43078}],"risk":0.40424000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125344","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125344","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125344","date":"2026-11-12","epss":0.00496,"percentile":0.43078}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/568893995"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125344","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125344","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125344","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125344","date":"2026-11-12","epss":0.00496,"percentile":0.43078}],"risk":0.40424000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125344","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125344","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125344","date":"2026-11-12","epss":0.00496,"percentile":0.43078}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/568893995"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125344","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.40019999999999994,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.40019999999999994,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.40019999999999994,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.40019999999999994,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"6819d24244f2b73c","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-2\\+deb13u1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/debian/libsndfile1@1.2.2-2%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=libsndfile","type":"deb","version":"1.2.2-2+deb13u1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libsndfile1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-37555","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libsndfile","version":"1.2.2-2+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-37555","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-37555","date":"2026-11-12","epss":0.00504,"percentile":0.43625}],"risk":0.39564,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-37555","description":"An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065."},"relatedVulnerabilities":[{"id":"CVE-2026-37555","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-37555","date":"2026-11-12","epss":0.00504,"percentile":0.43625}],"urls":["https://gist.github.com/sgInnora/a5f5c19e4bf6f4fb74fab7b0ef2bfcc1","https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151","https://github.com/libsndfile/libsndfile/issues/833","https://access.redhat.com/errata/RHSA-2026:19559","https://access.redhat.com/errata/RHSA-2026:19560","https://access.redhat.com/errata/RHSA-2026:19610","https://access.redhat.com/errata/RHSA-2026:23221","https://access.redhat.com/errata/RHSA-2026:23222","https://access.redhat.com/errata/RHSA-2026:23223","https://access.redhat.com/errata/RHSA-2026:25092","https://access.redhat.com/errata/RHSA-2026:25197","https://access.redhat.com/errata/RHSA-2026:25198","https://access.redhat.com/errata/RHSA-2026:25227","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/security/cve/CVE-2026-37555","https://bugzilla.redhat.com/show_bug.cgi?id=2463856","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-37555.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-37555","description":"An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121034","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121034","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121034","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121034","date":"2026-11-12","epss":0.00423,"percentile":0.37136}],"risk":0.39338999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121034","description":"Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121034","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121034","date":"2026-11-12","epss":0.00423,"percentile":0.37136}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400880"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121034","description":"Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121034","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121034","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121034","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121034","date":"2026-11-12","epss":0.00423,"percentile":0.37136}],"risk":0.39338999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121034","description":"Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121034","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121034","date":"2026-11-12","epss":0.00423,"percentile":0.37136}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400880"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121034","description":"Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121034","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121034","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121034","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121034","date":"2026-11-12","epss":0.00423,"percentile":0.37136}],"risk":0.39338999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121034","description":"Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121034","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121034","date":"2026-11-12","epss":0.00423,"percentile":0.37136}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400880"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121034","description":"Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121034","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121034","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121034","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121034","date":"2026-11-12","epss":0.00423,"percentile":0.37136}],"risk":0.39338999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121034","description":"Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121034","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121034","date":"2026-11-12","epss":0.00423,"percentile":0.37136}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400880"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121034","description":"Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121034","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121034","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121034","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121034","date":"2026-11-12","epss":0.00423,"percentile":0.37136}],"risk":0.39338999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121034","description":"Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121034","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121034","date":"2026-11-12","epss":0.00423,"percentile":0.37136}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400880"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121034","description":"Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"fb1cc646c716a53f","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.40.1-6%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=perl","type":"deb","version":"5.40.1-6+deb13u1","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"perl","version":"5.40.1-6+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-12","epss":0.00517,"percentile":0.44516}],"risk":0.38775,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.  _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.  A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-12","epss":0.00517,"percentile":0.44516}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121114","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121114","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121114","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121114","date":"2026-11-12","epss":0.00413,"percentile":0.36079}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121114","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121114","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121114","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121114","date":"2026-11-12","epss":0.00413,"percentile":0.36079}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573387527"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121114","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121114","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121114","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121114","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121114","date":"2026-11-12","epss":0.00413,"percentile":0.36079}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121114","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121114","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121114","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121114","date":"2026-11-12","epss":0.00413,"percentile":0.36079}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573387527"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121114","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121114","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121114","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121114","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121114","date":"2026-11-12","epss":0.00413,"percentile":0.36079}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121114","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121114","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121114","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121114","date":"2026-11-12","epss":0.00413,"percentile":0.36079}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573387527"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121114","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121114","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121114","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121114","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121114","date":"2026-11-12","epss":0.00413,"percentile":0.36079}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121114","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121114","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121114","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121114","date":"2026-11-12","epss":0.00413,"percentile":0.36079}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573387527"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121114","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121114","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121114","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121114","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121114","date":"2026-11-12","epss":0.00413,"percentile":0.36079}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121114","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121114","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121114","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121114","date":"2026-11-12","epss":0.00413,"percentile":0.36079}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573387527"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121114","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121126","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121126","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121126","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121126","description":"Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121126","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121126","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121126","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571284308"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121126","description":"Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121148","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121148","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121148","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121148","description":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121148","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571059182"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121148","description":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121185","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121185","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121185","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121185","description":"Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121185","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121185","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121185","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681453"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121185","description":"Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121189","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121189","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121189","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121189","description":"Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"},"relatedVulnerabilities":[{"id":"CVE-2026-121189","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121189","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121189","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/555547989"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121189","description":"Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121126","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121126","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121126","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121126","description":"Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121126","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121126","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121126","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571284308"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121126","description":"Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121148","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121148","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121148","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121148","description":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121148","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571059182"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121148","description":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121185","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121185","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121185","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121185","description":"Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121185","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121185","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121185","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681453"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121185","description":"Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121189","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121189","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121189","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121189","description":"Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"},"relatedVulnerabilities":[{"id":"CVE-2026-121189","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121189","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121189","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/555547989"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121189","description":"Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121126","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121126","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121126","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121126","description":"Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121126","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121126","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121126","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571284308"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121126","description":"Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121148","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121148","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121148","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121148","description":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121148","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571059182"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121148","description":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121185","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121185","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121185","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121185","description":"Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121185","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121185","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121185","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681453"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121185","description":"Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121189","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121189","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121189","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121189","description":"Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"},"relatedVulnerabilities":[{"id":"CVE-2026-121189","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121189","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121189","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/555547989"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121189","description":"Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121126","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121126","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121126","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121126","description":"Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121126","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121126","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121126","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571284308"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121126","description":"Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121148","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121148","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121148","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121148","description":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121148","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571059182"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121148","description":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121185","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121185","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121185","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121185","description":"Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121185","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121185","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121185","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681453"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121185","description":"Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121189","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121189","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121189","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121189","description":"Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"},"relatedVulnerabilities":[{"id":"CVE-2026-121189","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121189","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121189","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/555547989"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121189","description":"Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121126","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121126","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121126","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121126","description":"Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121126","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121126","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121126","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571284308"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121126","description":"Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121148","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121148","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121148","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121148","description":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121148","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571059182"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121148","description":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121185","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121185","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121185","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121185","description":"Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121185","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121185","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121185","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681453"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121185","description":"Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121189","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121189","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121189","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121189","description":"Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"},"relatedVulnerabilities":[{"id":"CVE-2026-121189","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121189","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121189","date":"2026-11-12","epss":0.00413,"percentile":0.36029}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/555547989"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121189","description":"Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121089","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121089","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121089","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121089","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121089","description":"Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121089","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121089","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121089","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571648522"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121089","description":"Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121214","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121214","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121214","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121214","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121214","description":"Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121214","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121214","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121214","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574412369"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121214","description":"Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121229","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121229","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121229","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121229","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121229","description":"Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121229","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121229","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121229","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562777838"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121229","description":"Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121246","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121246","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121246","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121246","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121246","description":"Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121246","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121246","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121246","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/558870371"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121246","description":"Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121089","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121089","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121089","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121089","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121089","description":"Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121089","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121089","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121089","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571648522"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121089","description":"Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121214","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121214","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121214","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121214","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121214","description":"Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121214","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121214","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121214","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574412369"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121214","description":"Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121229","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121229","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121229","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121229","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121229","description":"Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121229","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121229","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121229","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562777838"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121229","description":"Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121246","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121246","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121246","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121246","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121246","description":"Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121246","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121246","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121246","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/558870371"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121246","description":"Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121089","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121089","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121089","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121089","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121089","description":"Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121089","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121089","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121089","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571648522"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121089","description":"Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121214","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121214","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121214","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121214","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121214","description":"Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121214","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121214","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121214","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574412369"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121214","description":"Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121229","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121229","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121229","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121229","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121229","description":"Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121229","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121229","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121229","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562777838"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121229","description":"Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121246","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121246","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121246","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121246","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121246","description":"Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121246","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121246","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121246","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/558870371"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121246","description":"Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121089","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121089","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121089","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121089","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121089","description":"Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121089","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121089","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121089","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571648522"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121089","description":"Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121214","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121214","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121214","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121214","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121214","description":"Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121214","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121214","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121214","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574412369"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121214","description":"Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121229","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121229","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121229","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121229","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121229","description":"Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121229","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121229","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121229","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562777838"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121229","description":"Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121246","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121246","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121246","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121246","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121246","description":"Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121246","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121246","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121246","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/558870371"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121246","description":"Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121089","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121089","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121089","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121089","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121089","description":"Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121089","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121089","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121089","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571648522"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121089","description":"Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121214","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121214","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121214","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121214","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121214","description":"Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121214","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121214","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121214","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574412369"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121214","description":"Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121229","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121229","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121229","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121229","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121229","description":"Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121229","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121229","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121229","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/562777838"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121229","description":"Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121246","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121246","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121246","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121246","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121246","description":"Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121246","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121246","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121246","date":"2026-11-12","epss":0.00413,"percentile":0.36028}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/558870371"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121246","description":"Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121074","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121074","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121074","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121074","date":"2026-11-12","epss":0.00413,"percentile":0.36027}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121074","description":"Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121074","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121074","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121074","date":"2026-11-12","epss":0.00413,"percentile":0.36027}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/536617330"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121074","description":"Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121074","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121074","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121074","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121074","date":"2026-11-12","epss":0.00413,"percentile":0.36027}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121074","description":"Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121074","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121074","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121074","date":"2026-11-12","epss":0.00413,"percentile":0.36027}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/536617330"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121074","description":"Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121074","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121074","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121074","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121074","date":"2026-11-12","epss":0.00413,"percentile":0.36027}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121074","description":"Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121074","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121074","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121074","date":"2026-11-12","epss":0.00413,"percentile":0.36027}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/536617330"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121074","description":"Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121074","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121074","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121074","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121074","date":"2026-11-12","epss":0.00413,"percentile":0.36027}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121074","description":"Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121074","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121074","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121074","date":"2026-11-12","epss":0.00413,"percentile":0.36027}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/536617330"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121074","description":"Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121074","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121074","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121074","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121074","date":"2026-11-12","epss":0.00413,"percentile":0.36027}],"risk":0.38408999999999993,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121074","description":"Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121074","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121074","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121074","date":"2026-11-12","epss":0.00413,"percentile":0.36027}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/536617330"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121074","description":"Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121127","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121127","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121127","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121127","date":"2026-11-12","epss":0.00467,"percentile":0.40958}],"risk":0.380605,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121127","description":"Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121127","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121127","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121127","date":"2026-11-12","epss":0.00467,"percentile":0.40958}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573836121"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121127","description":"Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121127","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121127","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121127","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121127","date":"2026-11-12","epss":0.00467,"percentile":0.40958}],"risk":0.380605,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121127","description":"Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121127","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121127","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121127","date":"2026-11-12","epss":0.00467,"percentile":0.40958}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573836121"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121127","description":"Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121127","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121127","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121127","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121127","date":"2026-11-12","epss":0.00467,"percentile":0.40958}],"risk":0.380605,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121127","description":"Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121127","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121127","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121127","date":"2026-11-12","epss":0.00467,"percentile":0.40958}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573836121"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121127","description":"Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121127","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121127","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121127","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121127","date":"2026-11-12","epss":0.00467,"percentile":0.40958}],"risk":0.380605,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121127","description":"Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121127","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121127","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121127","date":"2026-11-12","epss":0.00467,"percentile":0.40958}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573836121"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121127","description":"Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121127","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121127","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121127","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121127","date":"2026-11-12","epss":0.00467,"percentile":0.40958}],"risk":0.380605,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121127","description":"Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121127","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121127","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121127","date":"2026-11-12","epss":0.00467,"percentile":0.40958}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/573836121"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121127","description":"Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121129","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121129","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121129","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121129","date":"2026-11-12","epss":0.00467,"percentile":0.40957}],"risk":0.380605,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121129","description":"Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121129","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121129","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121129","date":"2026-11-12","epss":0.00467,"percentile":0.40957}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577403757"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121129","description":"Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121129","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121129","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121129","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121129","date":"2026-11-12","epss":0.00467,"percentile":0.40957}],"risk":0.380605,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121129","description":"Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121129","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121129","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121129","date":"2026-11-12","epss":0.00467,"percentile":0.40957}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577403757"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121129","description":"Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121129","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121129","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121129","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121129","date":"2026-11-12","epss":0.00467,"percentile":0.40957}],"risk":0.380605,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121129","description":"Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121129","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121129","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121129","date":"2026-11-12","epss":0.00467,"percentile":0.40957}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577403757"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121129","description":"Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121129","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121129","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121129","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121129","date":"2026-11-12","epss":0.00467,"percentile":0.40957}],"risk":0.380605,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121129","description":"Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121129","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121129","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121129","date":"2026-11-12","epss":0.00467,"percentile":0.40957}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577403757"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121129","description":"Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121129","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121129","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121129","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121129","date":"2026-11-12","epss":0.00467,"percentile":0.40957}],"risk":0.380605,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121129","description":"Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121129","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121129","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121129","date":"2026-11-12","epss":0.00467,"percentile":0.40957}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577403757"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121129","description":"Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121030","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121030","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121030","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121030","date":"2026-11-12","epss":0.00407,"percentile":0.35514}],"risk":0.37850999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121030","description":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121030","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121030","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121030","date":"2026-11-12","epss":0.00407,"percentile":0.35514}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553152519"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121030","description":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121030","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121030","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121030","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121030","date":"2026-11-12","epss":0.00407,"percentile":0.35514}],"risk":0.37850999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121030","description":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121030","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121030","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121030","date":"2026-11-12","epss":0.00407,"percentile":0.35514}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553152519"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121030","description":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121030","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121030","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121030","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121030","date":"2026-11-12","epss":0.00407,"percentile":0.35514}],"risk":0.37850999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121030","description":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121030","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121030","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121030","date":"2026-11-12","epss":0.00407,"percentile":0.35514}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553152519"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121030","description":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121030","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121030","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121030","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121030","date":"2026-11-12","epss":0.00407,"percentile":0.35514}],"risk":0.37850999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121030","description":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121030","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121030","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121030","date":"2026-11-12","epss":0.00407,"percentile":0.35514}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553152519"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121030","description":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121030","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121030","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121030","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121030","date":"2026-11-12","epss":0.00407,"percentile":0.35514}],"risk":0.37850999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121030","description":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121030","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121030","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121030","date":"2026-11-12","epss":0.00407,"percentile":0.35514}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553152519"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121030","description":"Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121060","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121060","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121060","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121060","date":"2026-11-12","epss":0.00407,"percentile":0.35513}],"risk":0.37850999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121060","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121060","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121060","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121060","date":"2026-11-12","epss":0.00407,"percentile":0.35513}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578500839"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121060","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121060","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121060","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121060","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121060","date":"2026-11-12","epss":0.00407,"percentile":0.35513}],"risk":0.37850999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121060","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121060","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121060","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121060","date":"2026-11-12","epss":0.00407,"percentile":0.35513}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578500839"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121060","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121060","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121060","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121060","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121060","date":"2026-11-12","epss":0.00407,"percentile":0.35513}],"risk":0.37850999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121060","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121060","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121060","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121060","date":"2026-11-12","epss":0.00407,"percentile":0.35513}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578500839"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121060","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121060","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121060","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121060","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121060","date":"2026-11-12","epss":0.00407,"percentile":0.35513}],"risk":0.37850999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121060","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121060","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121060","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121060","date":"2026-11-12","epss":0.00407,"percentile":0.35513}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578500839"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121060","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121060","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121060","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121060","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121060","date":"2026-11-12","epss":0.00407,"percentile":0.35513}],"risk":0.37850999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121060","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121060","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121060","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121060","date":"2026-11-12","epss":0.00407,"percentile":0.35513}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578500839"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121060","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"4ecf19088377af64","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-12","epss":0.00726,"percentile":0.54631}],"risk":0.37389,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-12","epss":0.00726,"percentile":0.54631}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"c7472053ac017f54","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-12","epss":0.00726,"percentile":0.54631}],"risk":0.37389,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-12","epss":0.00726,"percentile":0.54631}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"e805de280e250033","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-12","epss":0.00726,"percentile":0.54631}],"risk":0.37389,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-11-12","epss":0.00726,"percentile":0.54631}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"62baf9dec50fa086","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.9.0-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.9.0-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.9.0-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113351","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.9.0-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-113351","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-12","epss":0.00494,"percentile":0.42915}],"risk":0.3705,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-113351","description":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated."},"relatedVulnerabilities":[{"id":"CVE-2026-113351","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-12","epss":0.00494,"percentile":0.42915}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884","https://github.com/libexpat/libexpat/pull/1431","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351","description":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121071","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121071","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121071","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121071","date":"2026-11-12","epss":0.00397,"percentile":0.34444}],"risk":0.3692099999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121071","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121071","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121071","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121071","date":"2026-11-12","epss":0.00397,"percentile":0.34444}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/561994040"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121071","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121071","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121071","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121071","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121071","date":"2026-11-12","epss":0.00397,"percentile":0.34444}],"risk":0.3692099999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121071","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121071","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121071","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121071","date":"2026-11-12","epss":0.00397,"percentile":0.34444}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/561994040"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121071","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121071","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121071","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121071","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121071","date":"2026-11-12","epss":0.00397,"percentile":0.34444}],"risk":0.3692099999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121071","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121071","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121071","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121071","date":"2026-11-12","epss":0.00397,"percentile":0.34444}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/561994040"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121071","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121071","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121071","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121071","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121071","date":"2026-11-12","epss":0.00397,"percentile":0.34444}],"risk":0.3692099999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121071","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121071","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121071","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121071","date":"2026-11-12","epss":0.00397,"percentile":0.34444}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/561994040"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121071","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121071","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121071","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121071","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121071","date":"2026-11-12","epss":0.00397,"percentile":0.34444}],"risk":0.3692099999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121071","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121071","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121071","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121071","date":"2026-11-12","epss":0.00397,"percentile":0.34444}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/561994040"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121071","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"968cab04caa47ab3","cpes":["cpe:2.3:a:gcc-14-base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14-base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*"],"name":"gcc-14-base","purl":"pkg:deb/debian/gcc-14-base@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/gcc-14-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-14-base:arm64.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/gcc-14-base:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"risk":0.36632,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"64d344f35c5fd422","cpes":["cpe:2.3:a:libatomic1:libatomic1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libatomic1","purl":"pkg:deb/debian/libatomic1@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/libatomic1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libatomic1:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libatomic1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"risk":0.36632,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"138a9da489396cfc","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/debian/libgcc-s1@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:arm64.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libgcc-s1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"risk":0.36632,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"436375387486e8f6","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:14.2.0-19:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:arm64.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libstdc++6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"risk":0.36632,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"968cab04caa47ab3","cpes":["cpe:2.3:a:gcc-14-base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14-base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*"],"name":"gcc-14-base","purl":"pkg:deb/debian/gcc-14-base@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/gcc-14-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-14-base:arm64.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/gcc-14-base:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"risk":0.36515000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"64d344f35c5fd422","cpes":["cpe:2.3:a:libatomic1:libatomic1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libatomic1","purl":"pkg:deb/debian/libatomic1@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/libatomic1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libatomic1:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libatomic1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"risk":0.36515000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"138a9da489396cfc","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/debian/libgcc-s1@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:arm64.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libgcc-s1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"risk":0.36515000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"436375387486e8f6","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:14.2.0-19:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:arm64.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libstdc++6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"risk":0.36515000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-125343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125343","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125343","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125343","date":"2026-11-12","epss":0.0046,"percentile":0.40304}],"risk":0.3634,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125343","description":"Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125343","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125343","date":"2026-11-12","epss":0.0046,"percentile":0.40304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/561998123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125343","description":"Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125343","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125343","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125343","date":"2026-11-12","epss":0.0046,"percentile":0.40304}],"risk":0.3634,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125343","description":"Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125343","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125343","date":"2026-11-12","epss":0.0046,"percentile":0.40304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/561998123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125343","description":"Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125343","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125343","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125343","date":"2026-11-12","epss":0.0046,"percentile":0.40304}],"risk":0.3634,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125343","description":"Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125343","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125343","date":"2026-11-12","epss":0.0046,"percentile":0.40304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/561998123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125343","description":"Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125343","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125343","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125343","date":"2026-11-12","epss":0.0046,"percentile":0.40304}],"risk":0.3634,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125343","description":"Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125343","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125343","date":"2026-11-12","epss":0.0046,"percentile":0.40304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/561998123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125343","description":"Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125343","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125343","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125343","date":"2026-11-12","epss":0.0046,"percentile":0.40304}],"risk":0.3634,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125343","description":"Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125343","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125343","date":"2026-11-12","epss":0.0046,"percentile":0.40304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/561998123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125343","description":"Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"32e2516577af1ce8","cpes":["cpe:2.3:a:libncursesw6:libncursesw6:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"libncursesw6","purl":"pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=arm64&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/libncursesw6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw6:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libncursesw6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69720","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-69720","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-11-12","epss":0.00475,"percentile":0.4155}],"risk":0.363375,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."},"relatedVulnerabilities":[{"id":"CVE-2025-69720","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-11-12","epss":0.00475,"percentile":0.4155}],"urls":["https://github.com/Cao-Wuhui/CVE-2025-69720","https://invisible-island.net/archives/ncurses/6.5/","https://invisible-island.net/ncurses/","https://marc.info/?l=ncurses-bug&m=176539968328570&w=2","https://marc.info/?l=ncurses-bug&m=176540731801330&w=2","https://marc.info/?l=ncurses-bug&m=176545557728083&w=2","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}]},{"artifact":{"id":"109ce5d685f813c6","cpes":["cpe:2.3:a:libtinfo6:libtinfo6:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"libtinfo6","purl":"pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=arm64&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/libtinfo6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo6:arm64.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libtinfo6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69720","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-69720","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-11-12","epss":0.00475,"percentile":0.4155}],"risk":0.363375,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."},"relatedVulnerabilities":[{"id":"CVE-2025-69720","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-11-12","epss":0.00475,"percentile":0.4155}],"urls":["https://github.com/Cao-Wuhui/CVE-2025-69720","https://invisible-island.net/archives/ncurses/6.5/","https://invisible-island.net/ncurses/","https://marc.info/?l=ncurses-bug&m=176539968328570&w=2","https://marc.info/?l=ncurses-bug&m=176540731801330&w=2","https://marc.info/?l=ncurses-bug&m=176545557728083&w=2","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}]},{"artifact":{"id":"3f9378db54aaac9e","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69720","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-69720","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-11-12","epss":0.00475,"percentile":0.4155}],"risk":0.363375,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."},"relatedVulnerabilities":[{"id":"CVE-2025-69720","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-11-12","epss":0.00475,"percentile":0.4155}],"urls":["https://github.com/Cao-Wuhui/CVE-2025-69720","https://invisible-island.net/archives/ncurses/6.5/","https://invisible-island.net/ncurses/","https://marc.info/?l=ncurses-bug&m=176539968328570&w=2","https://marc.info/?l=ncurses-bug&m=176540731801330&w=2","https://marc.info/?l=ncurses-bug&m=176545557728083&w=2","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}]},{"artifact":{"id":"a6728d83d34dc83a","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=arm64&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69720","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-69720","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-11-12","epss":0.00475,"percentile":0.4155}],"risk":0.363375,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."},"relatedVulnerabilities":[{"id":"CVE-2025-69720","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-11-12","epss":0.00475,"percentile":0.4155}],"urls":["https://github.com/Cao-Wuhui/CVE-2025-69720","https://invisible-island.net/archives/ncurses/6.5/","https://invisible-island.net/ncurses/","https://marc.info/?l=ncurses-bug&m=176539968328570&w=2","https://marc.info/?l=ncurses-bug&m=176540731801330&w=2","https://marc.info/?l=ncurses-bug&m=176545557728083&w=2","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}]},{"artifact":{"id":"62baf9dec50fa086","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.9.0-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.9.0-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.9.0-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115506","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.9.0-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-115506","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-12","epss":0.00448,"percentile":0.3943}],"risk":0.3628799999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-115506","description":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse."},"relatedVulnerabilities":[{"id":"CVE-2026-115506","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-12","epss":0.00448,"percentile":0.3943}],"urls":["https://github.com/hannob/lololol","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/issues/1160","https://github.com/libexpat/libexpat/pull/1433","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115506","description":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121057","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121057","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121057","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121057","date":"2026-11-12","epss":0.00442,"percentile":0.38919}],"risk":0.36023000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121057","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121057","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121057","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121057","date":"2026-11-12","epss":0.00442,"percentile":0.38919}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574038247"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121057","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121057","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121057","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121057","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121057","date":"2026-11-12","epss":0.00442,"percentile":0.38919}],"risk":0.36023000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121057","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121057","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121057","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121057","date":"2026-11-12","epss":0.00442,"percentile":0.38919}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574038247"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121057","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121057","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121057","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121057","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121057","date":"2026-11-12","epss":0.00442,"percentile":0.38919}],"risk":0.36023000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121057","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121057","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121057","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121057","date":"2026-11-12","epss":0.00442,"percentile":0.38919}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574038247"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121057","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121057","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121057","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121057","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121057","date":"2026-11-12","epss":0.00442,"percentile":0.38919}],"risk":0.36023000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121057","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121057","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121057","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121057","date":"2026-11-12","epss":0.00442,"percentile":0.38919}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574038247"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121057","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121057","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121057","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121057","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121057","date":"2026-11-12","epss":0.00442,"percentile":0.38919}],"risk":0.36023000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121057","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121057","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121057","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121057","date":"2026-11-12","epss":0.00442,"percentile":0.38919}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574038247"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121057","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121131","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121131","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121131","date":"2026-11-12","epss":0.00381,"percentile":0.32554}],"risk":0.35433,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121131","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121131","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121131","date":"2026-11-12","epss":0.00381,"percentile":0.32554}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026889"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121131","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121131","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121131","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121131","date":"2026-11-12","epss":0.00381,"percentile":0.32554}],"risk":0.35433,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121131","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121131","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121131","date":"2026-11-12","epss":0.00381,"percentile":0.32554}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026889"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121131","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121131","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121131","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121131","date":"2026-11-12","epss":0.00381,"percentile":0.32554}],"risk":0.35433,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121131","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121131","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121131","date":"2026-11-12","epss":0.00381,"percentile":0.32554}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026889"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121131","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121131","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121131","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121131","date":"2026-11-12","epss":0.00381,"percentile":0.32554}],"risk":0.35433,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121131","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121131","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121131","date":"2026-11-12","epss":0.00381,"percentile":0.32554}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026889"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121131","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121131","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121131","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121131","date":"2026-11-12","epss":0.00381,"percentile":0.32554}],"risk":0.35433,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121131","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121131","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121131","date":"2026-11-12","epss":0.00381,"percentile":0.32554}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026889"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121131","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121200","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121200","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121200","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121200","date":"2026-11-12","epss":0.00368,"percentile":0.31141}],"risk":0.34224,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121200","description":"Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121200","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121200","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121200","date":"2026-11-12","epss":0.00368,"percentile":0.31141}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/528485835"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121200","description":"Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121200","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121200","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121200","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121200","date":"2026-11-12","epss":0.00368,"percentile":0.31141}],"risk":0.34224,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121200","description":"Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121200","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121200","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121200","date":"2026-11-12","epss":0.00368,"percentile":0.31141}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/528485835"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121200","description":"Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121200","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121200","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121200","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121200","date":"2026-11-12","epss":0.00368,"percentile":0.31141}],"risk":0.34224,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121200","description":"Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121200","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121200","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121200","date":"2026-11-12","epss":0.00368,"percentile":0.31141}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/528485835"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121200","description":"Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121200","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121200","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121200","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121200","date":"2026-11-12","epss":0.00368,"percentile":0.31141}],"risk":0.34224,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121200","description":"Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121200","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121200","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121200","date":"2026-11-12","epss":0.00368,"percentile":0.31141}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/528485835"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121200","description":"Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121200","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121200","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121200","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121200","date":"2026-11-12","epss":0.00368,"percentile":0.31141}],"risk":0.34224,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121200","description":"Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121200","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121200","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121200","date":"2026-11-12","epss":0.00368,"percentile":0.31141}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/528485835"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121200","description":"Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.340415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.340415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.340415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.340415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2023-39329","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-11-12","epss":0.00588,"percentile":0.48618}],"risk":0.33809999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-39329","description":"A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-39329","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-11-12","epss":0.00588,"percentile":0.48618}],"urls":["https://access.redhat.com/errata/RHSA-2026:4128","https://access.redhat.com/security/cve/CVE-2023-39329","https://bugzilla.redhat.com/show_bug.cgi?id=2295816","https://github.com/uclouvain/openjpeg/issues/1474"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39329","description":"A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-125348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125348","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125348","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125348","date":"2026-11-12","epss":0.0041,"percentile":0.35721}],"risk":0.33415000000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125348","description":"Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125348","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125348","date":"2026-11-12","epss":0.0041,"percentile":0.35721}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/563358700"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125348","description":"Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125348","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125348","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125348","date":"2026-11-12","epss":0.0041,"percentile":0.35721}],"risk":0.33415000000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125348","description":"Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125348","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125348","date":"2026-11-12","epss":0.0041,"percentile":0.35721}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/563358700"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125348","description":"Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125348","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125348","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125348","date":"2026-11-12","epss":0.0041,"percentile":0.35721}],"risk":0.33415000000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125348","description":"Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125348","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125348","date":"2026-11-12","epss":0.0041,"percentile":0.35721}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/563358700"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125348","description":"Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125348","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125348","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125348","date":"2026-11-12","epss":0.0041,"percentile":0.35721}],"risk":0.33415000000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125348","description":"Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125348","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125348","date":"2026-11-12","epss":0.0041,"percentile":0.35721}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/563358700"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125348","description":"Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-125348","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125348","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125348","date":"2026-11-12","epss":0.0041,"percentile":0.35721}],"risk":0.33415000000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-125348","description":"Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-125348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125348","cwe":"CWE-787","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125348","date":"2026-11-12","epss":0.0041,"percentile":0.35721}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/563358700"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125348","description":"Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"25e48be699bee41c","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=arm64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libxml2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6653","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6653","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6653","cwe":"CWE-416","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-6653","cwe":"CWE-611","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-6653","date":"2026-11-12","epss":0.00355,"percentile":0.29679}],"risk":0.33370000000000005,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6653","description":"Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling."},"relatedVulnerabilities":[{"id":"CVE-2026-6653","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6653","cwe":"CWE-416","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-6653","cwe":"CWE-611","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-6653","date":"2026-11-12","epss":0.00355,"percentile":0.29679}],"urls":["https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260","https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6653","description":"Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121044","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121044","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121044","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121044","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"risk":0.3308900000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121044","description":"Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121044","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121044","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121044","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568832157"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121044","description":"Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121052","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121052","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121052","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"risk":0.3308900000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121052","description":"Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121052","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121052","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121052","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569129173"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121052","description":"Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121044","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121044","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121044","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121044","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"risk":0.3308900000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121044","description":"Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121044","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121044","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121044","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568832157"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121044","description":"Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121052","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121052","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121052","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"risk":0.3308900000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121052","description":"Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121052","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121052","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121052","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569129173"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121052","description":"Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121044","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121044","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121044","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121044","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"risk":0.3308900000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121044","description":"Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121044","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121044","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121044","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568832157"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121044","description":"Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121052","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121052","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121052","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"risk":0.3308900000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121052","description":"Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121052","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121052","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121052","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569129173"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121052","description":"Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121044","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121044","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121044","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121044","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"risk":0.3308900000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121044","description":"Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121044","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121044","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121044","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568832157"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121044","description":"Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121052","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121052","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121052","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"risk":0.3308900000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121052","description":"Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121052","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121052","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121052","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569129173"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121052","description":"Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121044","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121044","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121044","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121044","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"risk":0.3308900000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121044","description":"Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121044","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121044","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121044","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568832157"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121044","description":"Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121052","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121052","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121052","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"risk":0.3308900000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121052","description":"Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121052","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121052","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121052","date":"2026-11-12","epss":0.00406,"percentile":0.35329}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569129173"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121052","description":"Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121068","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121068","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121068","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121068","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121068","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121068","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121068","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121068","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577327383"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121068","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121082","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121082","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121082","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121082","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121082","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121082","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121082","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121082","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567222737"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121082","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121094","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121094","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121094","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121094","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121094","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121094","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121094","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574339635"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121094","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121226","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121226","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121226","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121226","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121226","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121226","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121226","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121226","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577318603"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121226","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121068","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121068","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121068","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121068","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121068","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121068","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121068","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121068","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577327383"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121068","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121082","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121082","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121082","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121082","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121082","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121082","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121082","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121082","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567222737"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121082","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121094","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121094","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121094","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121094","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121094","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121094","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121094","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574339635"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121094","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121226","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121226","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121226","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121226","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121226","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121226","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121226","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121226","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577318603"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121226","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121068","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121068","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121068","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121068","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121068","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121068","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121068","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121068","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577327383"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121068","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121082","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121082","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121082","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121082","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121082","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121082","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121082","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121082","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567222737"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121082","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121094","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121094","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121094","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121094","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121094","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121094","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121094","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574339635"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121094","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121226","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121226","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121226","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121226","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121226","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121226","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121226","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121226","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577318603"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121226","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121068","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121068","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121068","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121068","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121068","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121068","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121068","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121068","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577327383"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121068","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121082","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121082","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121082","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121082","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121082","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121082","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121082","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121082","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567222737"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121082","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121094","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121094","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121094","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121094","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121094","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121094","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121094","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574339635"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121094","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121226","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121226","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121226","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121226","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121226","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121226","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121226","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121226","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577318603"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121226","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121068","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121068","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121068","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121068","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121068","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121068","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121068","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121068","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577327383"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121068","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121082","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121082","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121082","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121082","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121082","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121082","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121082","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121082","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567222737"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121082","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121094","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121094","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121094","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121094","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121094","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121094","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121094","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574339635"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121094","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121226","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121226","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121226","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121226","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121226","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121226","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121226","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121226","date":"2026-11-12","epss":0.00403,"percentile":0.35055}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577318603"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121226","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121137","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121137","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121137","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121137","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121137","description":"Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121137","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121137","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121137","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577352626"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121137","description":"Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121210","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121210","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121210","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121210","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121210","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121210","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574021176"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121210","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121218","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121218","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121218","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121218","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121218","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121218","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121218","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568010379"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121218","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121221","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121221","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121221","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121221","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121221","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121221","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121221","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578688670"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121221","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121233","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121233","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121233","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121233","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121233","description":"Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121233","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121233","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121233","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/552757015"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121233","description":"Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121137","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121137","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121137","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121137","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121137","description":"Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121137","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121137","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121137","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577352626"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121137","description":"Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121210","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121210","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121210","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121210","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121210","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121210","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574021176"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121210","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121218","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121218","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121218","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121218","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121218","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121218","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121218","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568010379"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121218","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121221","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121221","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121221","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121221","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121221","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121221","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121221","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578688670"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121221","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121233","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121233","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121233","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121233","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121233","description":"Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121233","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121233","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121233","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/552757015"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121233","description":"Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121137","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121137","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121137","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121137","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121137","description":"Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121137","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121137","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121137","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577352626"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121137","description":"Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121210","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121210","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121210","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121210","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121210","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121210","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574021176"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121210","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121218","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121218","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121218","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121218","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121218","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121218","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121218","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568010379"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121218","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121221","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121221","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121221","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121221","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121221","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121221","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121221","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578688670"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121221","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121233","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121233","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121233","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121233","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121233","description":"Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121233","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121233","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121233","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/552757015"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121233","description":"Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121137","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121137","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121137","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121137","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121137","description":"Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121137","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121137","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121137","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577352626"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121137","description":"Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121210","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121210","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121210","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121210","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121210","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121210","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574021176"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121210","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121218","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121218","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121218","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121218","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121218","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121218","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121218","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568010379"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121218","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121221","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121221","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121221","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121221","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121221","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121221","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121221","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578688670"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121221","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121233","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121233","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121233","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121233","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121233","description":"Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121233","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121233","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121233","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/552757015"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121233","description":"Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121137","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121137","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121137","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121137","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121137","description":"Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121137","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121137","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121137","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577352626"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121137","description":"Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121210","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121210","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121210","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121210","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121210","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121210","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121210","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574021176"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121210","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121218","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121218","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121218","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121218","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121218","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121218","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121218","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568010379"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121218","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121221","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121221","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121221","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121221","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121221","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121221","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121221","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578688670"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121221","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121233","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121233","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121233","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121233","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121233","description":"Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121233","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121233","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121233","date":"2026-11-12","epss":0.00403,"percentile":0.35054}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/552757015"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121233","description":"Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121078","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121078","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121078","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121078","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121078","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121078","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121078","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121078","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578083257"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121078","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121228","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121228","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121228","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121228","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121228","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121228","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121228","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568794851"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121228","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121078","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121078","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121078","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121078","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121078","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121078","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121078","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121078","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578083257"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121078","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121228","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121228","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121228","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121228","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121228","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121228","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121228","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568794851"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121228","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121078","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121078","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121078","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121078","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121078","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121078","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121078","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121078","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578083257"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121078","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121228","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121228","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121228","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121228","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121228","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121228","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121228","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568794851"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121228","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121078","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121078","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121078","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121078","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121078","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121078","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121078","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121078","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578083257"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121078","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121228","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121228","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121228","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121228","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121228","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121228","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121228","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568794851"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121228","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121078","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121078","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121078","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121078","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121078","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121078","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121078","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121078","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578083257"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121078","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121228","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121228","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121228","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"risk":0.328445,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121228","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121228","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121228","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121228","date":"2026-11-12","epss":0.00403,"percentile":0.35053}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568794851"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121228","description":"Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.32775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.32775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.32775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.32775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121180","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121180","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121180","date":"2026-11-12","epss":0.00402,"percentile":0.34973}],"risk":0.32763000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121180","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121180","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121180","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121180","date":"2026-11-12","epss":0.00402,"percentile":0.34973}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936265"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121180","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121180","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121180","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121180","date":"2026-11-12","epss":0.00402,"percentile":0.34973}],"risk":0.32763000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121180","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121180","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121180","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121180","date":"2026-11-12","epss":0.00402,"percentile":0.34973}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936265"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121180","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121180","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121180","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121180","date":"2026-11-12","epss":0.00402,"percentile":0.34973}],"risk":0.32763000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121180","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121180","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121180","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121180","date":"2026-11-12","epss":0.00402,"percentile":0.34973}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936265"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121180","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121180","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121180","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121180","date":"2026-11-12","epss":0.00402,"percentile":0.34973}],"risk":0.32763000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121180","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121180","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121180","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121180","date":"2026-11-12","epss":0.00402,"percentile":0.34973}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936265"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121180","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121180","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121180","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121180","date":"2026-11-12","epss":0.00402,"percentile":0.34973}],"risk":0.32763000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121180","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121180","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121180","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121180","date":"2026-11-12","epss":0.00402,"percentile":0.34973}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936265"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121180","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"4ecf19088377af64","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-12","epss":0.00622,"percentile":0.50347}],"risk":0.32033,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-12","epss":0.00622,"percentile":0.50347}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"c7472053ac017f54","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-12","epss":0.00622,"percentile":0.50347}],"risk":0.32033,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-12","epss":0.00622,"percentile":0.50347}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"e805de280e250033","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-12","epss":0.00622,"percentile":0.50347}],"risk":0.32033,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-11-12","epss":0.00622,"percentile":0.50347}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"62baf9dec50fa086","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.9.0-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.9.0-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.9.0-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117610","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.9.0-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-117610","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-12","epss":0.00425,"percentile":0.37298}],"risk":0.31875000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-117610","description":"libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application."},"relatedVulnerabilities":[{"id":"CVE-2026-117610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-12","epss":0.00425,"percentile":0.37298}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510","https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d","https://github.com/libexpat/libexpat/pull/1444","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117610","description":"libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121098","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121098","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121098","cwe":"CWE-754","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121098","date":"2026-11-12","epss":0.00399,"percentile":0.34693}],"risk":0.31521,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121098","description":"Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121098","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121098","cwe":"CWE-754","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121098","date":"2026-11-12","epss":0.00399,"percentile":0.34693}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/516958782"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121098","description":"Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121098","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121098","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121098","cwe":"CWE-754","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121098","date":"2026-11-12","epss":0.00399,"percentile":0.34693}],"risk":0.31521,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121098","description":"Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121098","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121098","cwe":"CWE-754","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121098","date":"2026-11-12","epss":0.00399,"percentile":0.34693}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/516958782"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121098","description":"Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121098","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121098","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121098","cwe":"CWE-754","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121098","date":"2026-11-12","epss":0.00399,"percentile":0.34693}],"risk":0.31521,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121098","description":"Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121098","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121098","cwe":"CWE-754","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121098","date":"2026-11-12","epss":0.00399,"percentile":0.34693}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/516958782"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121098","description":"Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121098","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121098","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121098","cwe":"CWE-754","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121098","date":"2026-11-12","epss":0.00399,"percentile":0.34693}],"risk":0.31521,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121098","description":"Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121098","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121098","cwe":"CWE-754","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121098","date":"2026-11-12","epss":0.00399,"percentile":0.34693}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/516958782"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121098","description":"Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121098","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121098","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121098","cwe":"CWE-754","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121098","date":"2026-11-12","epss":0.00399,"percentile":0.34693}],"risk":0.31521,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121098","description":"Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121098","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121098","cwe":"CWE-754","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121098","date":"2026-11-12","epss":0.00399,"percentile":0.34693}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/516958782"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121098","description":"Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121077","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121077","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121077","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121077","date":"2026-11-12","epss":0.00338,"percentile":0.27564}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121077","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121077","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121077","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121077","date":"2026-11-12","epss":0.00338,"percentile":0.27564}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026368"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121077","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121077","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121077","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121077","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121077","date":"2026-11-12","epss":0.00338,"percentile":0.27564}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121077","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121077","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121077","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121077","date":"2026-11-12","epss":0.00338,"percentile":0.27564}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026368"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121077","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121077","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121077","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121077","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121077","date":"2026-11-12","epss":0.00338,"percentile":0.27564}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121077","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121077","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121077","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121077","date":"2026-11-12","epss":0.00338,"percentile":0.27564}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026368"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121077","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121077","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121077","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121077","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121077","date":"2026-11-12","epss":0.00338,"percentile":0.27564}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121077","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121077","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121077","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121077","date":"2026-11-12","epss":0.00338,"percentile":0.27564}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026368"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121077","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121077","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121077","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121077","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121077","date":"2026-11-12","epss":0.00338,"percentile":0.27564}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121077","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121077","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121077","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121077","date":"2026-11-12","epss":0.00338,"percentile":0.27564}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570026368"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121077","description":"Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121076","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121076","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121076","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121076","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121076","description":"Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121076","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121076","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578670966"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121076","description":"Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121241","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121241","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121241","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121241","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121241","description":"Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121241","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121241","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121241","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574791491"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121241","description":"Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121076","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121076","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121076","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121076","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121076","description":"Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121076","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121076","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578670966"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121076","description":"Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121241","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121241","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121241","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121241","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121241","description":"Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121241","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121241","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121241","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574791491"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121241","description":"Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121076","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121076","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121076","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121076","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121076","description":"Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121076","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121076","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578670966"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121076","description":"Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121241","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121241","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121241","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121241","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121241","description":"Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121241","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121241","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121241","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574791491"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121241","description":"Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121076","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121076","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121076","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121076","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121076","description":"Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121076","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121076","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578670966"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121076","description":"Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121241","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121241","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121241","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121241","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121241","description":"Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121241","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121241","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121241","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574791491"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121241","description":"Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121076","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121076","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121076","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121076","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121076","description":"Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121076","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121076","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578670966"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121076","description":"Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121241","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121241","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121241","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121241","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121241","description":"Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121241","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121241","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121241","date":"2026-11-12","epss":0.00338,"percentile":0.27563}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574791491"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121241","description":"Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"968cab04caa47ab3","cpes":["cpe:2.3:a:gcc-14-base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14-base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*"],"name":"gcc-14-base","purl":"pkg:deb/debian/gcc-14-base@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/gcc-14-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-14-base:arm64.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/gcc-14-base:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"risk":0.311025,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98474","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:98483","https://access.redhat.com/errata/RHSA-2026:98576","https://access.redhat.com/errata/RHSA-2026:98577","https://access.redhat.com/errata/RHSA-2026:98580","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/errata/RHSA-2026:99041","https://access.redhat.com/errata/RHSA-2026:99089","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"64d344f35c5fd422","cpes":["cpe:2.3:a:libatomic1:libatomic1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libatomic1","purl":"pkg:deb/debian/libatomic1@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/libatomic1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libatomic1:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libatomic1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"risk":0.311025,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98474","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:98483","https://access.redhat.com/errata/RHSA-2026:98576","https://access.redhat.com/errata/RHSA-2026:98577","https://access.redhat.com/errata/RHSA-2026:98580","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/errata/RHSA-2026:99041","https://access.redhat.com/errata/RHSA-2026:99089","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"138a9da489396cfc","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/debian/libgcc-s1@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:arm64.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libgcc-s1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"risk":0.311025,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98474","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:98483","https://access.redhat.com/errata/RHSA-2026:98576","https://access.redhat.com/errata/RHSA-2026:98577","https://access.redhat.com/errata/RHSA-2026:98580","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/errata/RHSA-2026:99041","https://access.redhat.com/errata/RHSA-2026:99089","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"436375387486e8f6","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:14.2.0-19:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:arm64.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libstdc++6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"risk":0.311025,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98474","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:98483","https://access.redhat.com/errata/RHSA-2026:98576","https://access.redhat.com/errata/RHSA-2026:98577","https://access.redhat.com/errata/RHSA-2026:98580","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/errata/RHSA-2026:99041","https://access.redhat.com/errata/RHSA-2026:99089","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"6819d24244f2b73c","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-2\\+deb13u1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/debian/libsndfile1@1.2.2-2%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=libsndfile","type":"deb","version":"1.2.2-2+deb13u1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libsndfile1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-50613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libsndfile","version":"1.2.2-2+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-50613","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-50613","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-50613","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-50613","date":"2026-11-12","epss":0.0054,"percentile":0.45929}],"risk":0.3105,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-50613","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close."},"relatedVulnerabilities":[{"id":"CVE-2024-50613","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-50613","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-50613","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-50613","date":"2026-11-12","epss":0.0054,"percentile":0.45929}],"urls":["https://github.com/libsndfile/libsndfile/issues/1034"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-50613","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close."}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.309995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.309995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.309995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.309995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"62baf9dec50fa086","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.9.0-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.9.0-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.9.0-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118370","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.9.0-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-118370","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-12","epss":0.00391,"percentile":0.33722}],"risk":0.30693499999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-118370","description":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory."},"relatedVulnerabilities":[{"id":"CVE-2026-118370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-12","epss":0.00391,"percentile":0.33722}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140","https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae","https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c","https://github.com/libexpat/libexpat/pull/1450","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118370","description":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121234","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121234","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121234","cwe":"CWE-250","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121234","date":"2026-11-12","epss":0.00328,"percentile":0.26319}],"risk":0.30504,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121234","description":"Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121234","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121234","cwe":"CWE-250","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121234","date":"2026-11-12","epss":0.00328,"percentile":0.26319}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/513767200"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121234","description":"Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121234","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121234","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121234","cwe":"CWE-250","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121234","date":"2026-11-12","epss":0.00328,"percentile":0.26319}],"risk":0.30504,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121234","description":"Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121234","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121234","cwe":"CWE-250","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121234","date":"2026-11-12","epss":0.00328,"percentile":0.26319}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/513767200"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121234","description":"Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121234","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121234","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121234","cwe":"CWE-250","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121234","date":"2026-11-12","epss":0.00328,"percentile":0.26319}],"risk":0.30504,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121234","description":"Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121234","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121234","cwe":"CWE-250","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121234","date":"2026-11-12","epss":0.00328,"percentile":0.26319}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/513767200"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121234","description":"Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121234","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121234","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121234","cwe":"CWE-250","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121234","date":"2026-11-12","epss":0.00328,"percentile":0.26319}],"risk":0.30504,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121234","description":"Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121234","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121234","cwe":"CWE-250","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121234","date":"2026-11-12","epss":0.00328,"percentile":0.26319}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/513767200"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121234","description":"Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121234","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121234","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121234","cwe":"CWE-250","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121234","date":"2026-11-12","epss":0.00328,"percentile":0.26319}],"risk":0.30504,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121234","description":"Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121234","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121234","cwe":"CWE-250","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121234","date":"2026-11-12","epss":0.00328,"percentile":0.26319}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/513767200"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121234","description":"Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121202","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121202","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121202","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121202","date":"2026-11-12","epss":0.00328,"percentile":0.26318}],"risk":0.30504,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121202","description":"Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121202","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121202","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121202","date":"2026-11-12","epss":0.00328,"percentile":0.26318}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566935544"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121202","description":"Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121202","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121202","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121202","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121202","date":"2026-11-12","epss":0.00328,"percentile":0.26318}],"risk":0.30504,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121202","description":"Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121202","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121202","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121202","date":"2026-11-12","epss":0.00328,"percentile":0.26318}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566935544"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121202","description":"Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121202","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121202","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121202","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121202","date":"2026-11-12","epss":0.00328,"percentile":0.26318}],"risk":0.30504,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121202","description":"Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121202","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121202","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121202","date":"2026-11-12","epss":0.00328,"percentile":0.26318}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566935544"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121202","description":"Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121202","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121202","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121202","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121202","date":"2026-11-12","epss":0.00328,"percentile":0.26318}],"risk":0.30504,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121202","description":"Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121202","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121202","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121202","date":"2026-11-12","epss":0.00328,"percentile":0.26318}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566935544"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121202","description":"Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121202","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121202","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121202","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121202","date":"2026-11-12","epss":0.00328,"percentile":0.26318}],"risk":0.30504,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121202","description":"Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121202","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121202","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121202","date":"2026-11-12","epss":0.00328,"percentile":0.26318}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566935544"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121202","description":"Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121104","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121104","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121104","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121104","date":"2026-11-12","epss":0.00325,"percentile":0.25945}],"risk":0.30224999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121104","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121104","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121104","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121104","date":"2026-11-12","epss":0.00325,"percentile":0.25945}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400245"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121104","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121104","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121104","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121104","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121104","date":"2026-11-12","epss":0.00325,"percentile":0.25945}],"risk":0.30224999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121104","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121104","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121104","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121104","date":"2026-11-12","epss":0.00325,"percentile":0.25945}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400245"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121104","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121104","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121104","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121104","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121104","date":"2026-11-12","epss":0.00325,"percentile":0.25945}],"risk":0.30224999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121104","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121104","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121104","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121104","date":"2026-11-12","epss":0.00325,"percentile":0.25945}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400245"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121104","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121104","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121104","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121104","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121104","date":"2026-11-12","epss":0.00325,"percentile":0.25945}],"risk":0.30224999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121104","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121104","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121104","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121104","date":"2026-11-12","epss":0.00325,"percentile":0.25945}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400245"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121104","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121104","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121104","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121104","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121104","date":"2026-11-12","epss":0.00325,"percentile":0.25945}],"risk":0.30224999999999996,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121104","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121104","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121104","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121104","date":"2026-11-12","epss":0.00325,"percentile":0.25945}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577400245"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121104","description":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121070","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121070","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121070","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121070","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121070","description":"Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121070","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121070","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121070","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567611695"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121070","description":"Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121181","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121181","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121181","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121181","description":"Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121181","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121181","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121181","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936269"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121181","description":"Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121070","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121070","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121070","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121070","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121070","description":"Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121070","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121070","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121070","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567611695"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121070","description":"Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121181","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121181","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121181","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121181","description":"Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121181","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121181","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121181","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936269"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121181","description":"Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121070","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121070","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121070","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121070","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121070","description":"Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121070","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121070","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121070","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567611695"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121070","description":"Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121181","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121181","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121181","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121181","description":"Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121181","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121181","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121181","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936269"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121181","description":"Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121070","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121070","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121070","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121070","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121070","description":"Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121070","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121070","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121070","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567611695"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121070","description":"Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121181","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121181","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121181","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121181","description":"Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121181","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121181","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121181","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936269"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121181","description":"Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121070","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121070","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121070","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121070","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121070","description":"Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121070","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121070","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121070","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567611695"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121070","description":"Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121181","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121181","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121181","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121181","description":"Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121181","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121181","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121181","date":"2026-11-12","epss":0.0037,"percentile":0.31308}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936269"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121181","description":"Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121083","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121083","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121083","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121083","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121083","description":"Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121083","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121083","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121083","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567321055"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121083","description":"Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121097","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121097","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121097","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121097","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121097","description":"Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121097","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121097","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121097","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574409275"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121097","description":"Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121100","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121100","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121100","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121100","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121100","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121100","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121100","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121100","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570796613"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121100","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121238","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121238","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121238","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121238","description":"Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121238","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121238","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569659190"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121238","description":"Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121083","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121083","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121083","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121083","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121083","description":"Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121083","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121083","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121083","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567321055"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121083","description":"Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121097","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121097","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121097","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121097","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121097","description":"Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121097","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121097","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121097","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574409275"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121097","description":"Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121100","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121100","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121100","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121100","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121100","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121100","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121100","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121100","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570796613"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121100","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121238","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121238","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121238","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121238","description":"Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121238","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121238","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569659190"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121238","description":"Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121083","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121083","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121083","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121083","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121083","description":"Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121083","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121083","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121083","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567321055"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121083","description":"Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121097","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121097","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121097","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121097","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121097","description":"Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121097","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121097","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121097","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574409275"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121097","description":"Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121100","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121100","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121100","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121100","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121100","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121100","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121100","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121100","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570796613"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121100","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121238","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121238","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121238","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121238","description":"Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121238","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121238","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569659190"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121238","description":"Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121083","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121083","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121083","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121083","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121083","description":"Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121083","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121083","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121083","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567321055"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121083","description":"Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121097","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121097","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121097","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121097","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121097","description":"Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121097","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121097","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121097","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574409275"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121097","description":"Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121100","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121100","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121100","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121100","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121100","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121100","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121100","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121100","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570796613"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121100","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121238","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121238","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121238","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121238","description":"Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121238","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121238","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569659190"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121238","description":"Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121083","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121083","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121083","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121083","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121083","description":"Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121083","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121083","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121083","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567321055"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121083","description":"Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121097","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121097","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121097","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121097","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121097","description":"Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121097","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121097","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121097","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574409275"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121097","description":"Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121100","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121100","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121100","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121100","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121100","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121100","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121100","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121100","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570796613"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121100","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121238","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121238","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121238","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121238","description":"Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121238","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121238","date":"2026-11-12","epss":0.0037,"percentile":0.31307}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/569659190"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121238","description":"Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121036","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121036","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121036","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121036","description":"Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121036","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121036","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121036","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577378379"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121036","description":"Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121061","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121061","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121061","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121061","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121061","description":"Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121061","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121061","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121061","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576723181"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121061","description":"Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121168","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121168","cwe":"CWE-668","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121168","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121168","description":"Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"},"relatedVulnerabilities":[{"id":"CVE-2026-121168","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121168","cwe":"CWE-668","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121168","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553161888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121168","description":"Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121201","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121201","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121201","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121201","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121201","description":"Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121201","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121201","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121201","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574193110"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121201","description":"Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121036","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121036","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121036","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121036","description":"Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121036","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121036","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121036","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577378379"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121036","description":"Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121061","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121061","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121061","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121061","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121061","description":"Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121061","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121061","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121061","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576723181"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121061","description":"Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121168","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121168","cwe":"CWE-668","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121168","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121168","description":"Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"},"relatedVulnerabilities":[{"id":"CVE-2026-121168","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121168","cwe":"CWE-668","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121168","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553161888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121168","description":"Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121201","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121201","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121201","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121201","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121201","description":"Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121201","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121201","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121201","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574193110"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121201","description":"Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121036","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121036","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121036","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121036","description":"Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121036","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121036","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121036","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577378379"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121036","description":"Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121061","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121061","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121061","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121061","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121061","description":"Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121061","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121061","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121061","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576723181"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121061","description":"Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121168","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121168","cwe":"CWE-668","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121168","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121168","description":"Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"},"relatedVulnerabilities":[{"id":"CVE-2026-121168","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121168","cwe":"CWE-668","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121168","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553161888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121168","description":"Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121201","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121201","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121201","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121201","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121201","description":"Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121201","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121201","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121201","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574193110"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121201","description":"Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121036","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121036","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121036","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121036","description":"Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121036","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121036","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121036","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577378379"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121036","description":"Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121061","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121061","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121061","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121061","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121061","description":"Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121061","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121061","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121061","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576723181"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121061","description":"Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121168","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121168","cwe":"CWE-668","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121168","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121168","description":"Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"},"relatedVulnerabilities":[{"id":"CVE-2026-121168","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121168","cwe":"CWE-668","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121168","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553161888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121168","description":"Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121201","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121201","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121201","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121201","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121201","description":"Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121201","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121201","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121201","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574193110"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121201","description":"Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121036","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121036","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121036","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121036","description":"Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121036","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121036","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121036","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577378379"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121036","description":"Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121061","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121061","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121061","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121061","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121061","description":"Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121061","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121061","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121061","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576723181"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121061","description":"Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121168","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121168","cwe":"CWE-668","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121168","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121168","description":"Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"},"relatedVulnerabilities":[{"id":"CVE-2026-121168","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121168","cwe":"CWE-668","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121168","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/553161888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121168","description":"Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121201","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121201","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121201","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121201","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121201","description":"Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121201","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121201","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121201","date":"2026-11-12","epss":0.0037,"percentile":0.31306}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/574193110"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121201","description":"Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121118","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121118","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121118","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121118","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121118","description":"Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121118","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121118","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121118","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566377255"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121118","description":"Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121188","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121188","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121188","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121188","description":"Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121188","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121188","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121188","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566506819"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121188","description":"Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121203","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121203","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121203","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121203","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121203","description":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121203","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121203","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121203","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571065824"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121203","description":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121208","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121208","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121208","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121208","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121208","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121208","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121208","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577402416"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121208","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121118","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121118","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121118","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121118","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121118","description":"Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121118","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121118","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121118","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566377255"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121118","description":"Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121188","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121188","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121188","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121188","description":"Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121188","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121188","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121188","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566506819"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121188","description":"Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121203","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121203","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121203","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121203","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121203","description":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121203","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121203","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121203","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571065824"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121203","description":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121208","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121208","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121208","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121208","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121208","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121208","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121208","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577402416"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121208","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121118","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121118","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121118","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121118","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121118","description":"Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121118","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121118","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121118","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566377255"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121118","description":"Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121188","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121188","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121188","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121188","description":"Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121188","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121188","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121188","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566506819"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121188","description":"Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121203","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121203","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121203","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121203","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121203","description":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121203","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121203","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121203","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571065824"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121203","description":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121208","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121208","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121208","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121208","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121208","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121208","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121208","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577402416"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121208","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121118","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121118","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121118","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121118","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121118","description":"Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121118","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121118","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121118","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566377255"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121118","description":"Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121188","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121188","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121188","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121188","description":"Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121188","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121188","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121188","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566506819"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121188","description":"Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121203","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121203","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121203","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121203","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121203","description":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121203","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121203","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121203","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571065824"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121203","description":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121208","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121208","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121208","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121208","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121208","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121208","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121208","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577402416"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121208","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121118","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121118","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121118","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121118","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121118","description":"Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121118","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121118","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121118","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566377255"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121118","description":"Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121188","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121188","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121188","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121188","description":"Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121188","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121188","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121188","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566506819"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121188","description":"Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121203","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121203","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121203","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121203","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121203","description":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-121203","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121203","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121203","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/571065824"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121203","description":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121208","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121208","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121208","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121208","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121208","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121208","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121208","date":"2026-11-12","epss":0.0037,"percentile":0.31305}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/577402416"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121208","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121117","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121117","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121117","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121117","description":"Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121117","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121117","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121117","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/575318807"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121117","description":"Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121123","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121123","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121123","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121123","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121123","description":"Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121123","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121123","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121123","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576097084"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121123","description":"Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121128","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121128","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121128","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121128","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121128","description":"Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121128","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121128","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121128","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568988525"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121128","description":"Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121182","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121182","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121182","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121182","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121182","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121182","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121182","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576169244"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121182","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121117","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121117","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121117","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121117","description":"Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121117","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121117","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121117","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/575318807"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121117","description":"Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121123","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121123","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121123","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121123","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121123","description":"Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121123","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121123","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121123","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576097084"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121123","description":"Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121128","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121128","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121128","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121128","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121128","description":"Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121128","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121128","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121128","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568988525"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121128","description":"Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121182","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121182","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121182","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121182","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121182","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121182","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121182","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576169244"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121182","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121117","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121117","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121117","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121117","description":"Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121117","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121117","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121117","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/575318807"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121117","description":"Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121123","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121123","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121123","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121123","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121123","description":"Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121123","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121123","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121123","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576097084"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121123","description":"Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121128","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121128","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121128","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121128","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121128","description":"Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121128","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121128","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121128","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568988525"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121128","description":"Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121182","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121182","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121182","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121182","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121182","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121182","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121182","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576169244"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121182","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121117","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121117","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121117","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121117","description":"Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121117","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121117","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121117","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/575318807"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121117","description":"Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121123","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121123","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121123","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121123","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121123","description":"Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121123","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121123","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121123","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576097084"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121123","description":"Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121128","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121128","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121128","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121128","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121128","description":"Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121128","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121128","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121128","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568988525"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121128","description":"Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121182","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121182","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121182","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121182","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121182","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121182","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121182","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576169244"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121182","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121117","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121117","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121117","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121117","description":"Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121117","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121117","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121117","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/575318807"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121117","description":"Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121123","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121123","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121123","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121123","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121123","description":"Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121123","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121123","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121123","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576097084"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121123","description":"Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121128","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121128","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121128","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121128","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121128","description":"Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121128","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121128","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121128","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/568988525"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121128","description":"Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121182","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121182","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121182","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121182","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121182","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121182","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121182","date":"2026-11-12","epss":0.0037,"percentile":0.31304}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/576169244"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121182","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121119","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121119","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121119","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121119","date":"2026-11-12","epss":0.0037,"percentile":0.31303}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121119","description":"Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121119","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121119","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121119","date":"2026-11-12","epss":0.0037,"percentile":0.31303}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578691880"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121119","description":"Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121119","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121119","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121119","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121119","date":"2026-11-12","epss":0.0037,"percentile":0.31303}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121119","description":"Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121119","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121119","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121119","date":"2026-11-12","epss":0.0037,"percentile":0.31303}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578691880"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121119","description":"Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121119","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121119","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121119","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121119","date":"2026-11-12","epss":0.0037,"percentile":0.31303}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121119","description":"Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121119","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121119","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121119","date":"2026-11-12","epss":0.0037,"percentile":0.31303}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578691880"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121119","description":"Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121119","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121119","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121119","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121119","date":"2026-11-12","epss":0.0037,"percentile":0.31303}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121119","description":"Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121119","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121119","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121119","date":"2026-11-12","epss":0.0037,"percentile":0.31303}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578691880"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121119","description":"Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121119","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121119","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121119","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121119","date":"2026-11-12","epss":0.0037,"percentile":0.31303}],"risk":0.30155000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121119","description":"Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121119","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121119","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121119","date":"2026-11-12","epss":0.0037,"percentile":0.31303}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/578691880"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121119","description":"Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.297155,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.297155,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.297155,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.297155,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121184","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121184","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121184","date":"2026-11-12","epss":0.00359,"percentile":0.30098}],"risk":0.29258500000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121184","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121184","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121184","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121184","date":"2026-11-12","epss":0.00359,"percentile":0.30098}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681451"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121184","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121184","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121184","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121184","date":"2026-11-12","epss":0.00359,"percentile":0.30098}],"risk":0.29258500000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121184","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121184","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121184","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121184","date":"2026-11-12","epss":0.00359,"percentile":0.30098}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681451"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121184","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121184","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121184","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121184","date":"2026-11-12","epss":0.00359,"percentile":0.30098}],"risk":0.29258500000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121184","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121184","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121184","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121184","date":"2026-11-12","epss":0.00359,"percentile":0.30098}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681451"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121184","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121184","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121184","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121184","date":"2026-11-12","epss":0.00359,"percentile":0.30098}],"risk":0.29258500000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121184","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121184","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121184","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121184","date":"2026-11-12","epss":0.00359,"percentile":0.30098}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681451"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121184","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121184","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121184","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121184","date":"2026-11-12","epss":0.00359,"percentile":0.30098}],"risk":0.29258500000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121184","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121184","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121184","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121184","date":"2026-11-12","epss":0.00359,"percentile":0.30098}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/565681451"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121184","description":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121124","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121124","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121124","cwe":"CWE-710","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121124","date":"2026-11-12","epss":0.00359,"percentile":0.30097}],"risk":0.29258500000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121124","description":"Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121124","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121124","cwe":"CWE-710","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121124","date":"2026-11-12","epss":0.00359,"percentile":0.30097}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566313798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121124","description":"Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121124","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121124","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121124","cwe":"CWE-710","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121124","date":"2026-11-12","epss":0.00359,"percentile":0.30097}],"risk":0.29258500000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121124","description":"Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121124","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121124","cwe":"CWE-710","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121124","date":"2026-11-12","epss":0.00359,"percentile":0.30097}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566313798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121124","description":"Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121124","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121124","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121124","cwe":"CWE-710","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121124","date":"2026-11-12","epss":0.00359,"percentile":0.30097}],"risk":0.29258500000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121124","description":"Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121124","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121124","cwe":"CWE-710","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121124","date":"2026-11-12","epss":0.00359,"percentile":0.30097}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566313798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121124","description":"Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121124","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121124","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121124","cwe":"CWE-710","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121124","date":"2026-11-12","epss":0.00359,"percentile":0.30097}],"risk":0.29258500000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121124","description":"Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121124","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121124","cwe":"CWE-710","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121124","date":"2026-11-12","epss":0.00359,"percentile":0.30097}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566313798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121124","description":"Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121124","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121124","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121124","cwe":"CWE-710","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121124","date":"2026-11-12","epss":0.00359,"percentile":0.30097}],"risk":0.29258500000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121124","description":"Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121124","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121124","cwe":"CWE-710","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121124","date":"2026-11-12","epss":0.00359,"percentile":0.30097}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566313798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121124","description":"Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"6819d24244f2b73c","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-2\\+deb13u1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/debian/libsndfile1@1.2.2-2%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=libsndfile","type":"deb","version":"1.2.2-2+deb13u1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libsndfile1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88372","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libsndfile","version":"1.2.2-2+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-88372","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88372","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88372","date":"2026-11-12","epss":0.0039,"percentile":0.33624}],"risk":0.2925,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88372","description":"libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files."},"relatedVulnerabilities":[{"id":"CVE-2026-88372","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88372","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88372","date":"2026-11-12","epss":0.0039,"percentile":0.33624}],"urls":["https://github.com/libsndfile/libsndfile/issues/1151"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88372","description":"libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:811ed5ec8bc0a1a475acb253d144913bb6b60b923fe9376439846aeeb4b3eb3b","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:328d8464a88e9a208febb4fee7698493fec2177f326751db62702e8917fcf02c","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121257","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121257","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121257","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121257","date":"2026-11-12","epss":0.00312,"percentile":0.24441}],"risk":0.29016,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121257","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121257","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121257","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121257","date":"2026-11-12","epss":0.00312,"percentile":0.24441}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567672825"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121257","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121257","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121257","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121257","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121257","date":"2026-11-12","epss":0.00312,"percentile":0.24441}],"risk":0.29016,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121257","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121257","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121257","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121257","date":"2026-11-12","epss":0.00312,"percentile":0.24441}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567672825"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121257","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121257","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121257","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121257","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121257","date":"2026-11-12","epss":0.00312,"percentile":0.24441}],"risk":0.29016,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121257","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121257","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121257","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121257","date":"2026-11-12","epss":0.00312,"percentile":0.24441}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567672825"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121257","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121257","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121257","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121257","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121257","date":"2026-11-12","epss":0.00312,"percentile":0.24441}],"risk":0.29016,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121257","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121257","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121257","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121257","date":"2026-11-12","epss":0.00312,"percentile":0.24441}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567672825"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121257","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121257","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121257","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121257","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121257","date":"2026-11-12","epss":0.00312,"percentile":0.24441}],"risk":0.29016,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121257","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121257","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121257","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121257","date":"2026-11-12","epss":0.00312,"percentile":0.24441}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567672825"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121257","description":"Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121250","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121250","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121250","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121250","date":"2026-11-12","epss":0.00312,"percentile":0.24399}],"risk":0.29016,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121250","description":"Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121250","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121250","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121250","date":"2026-11-12","epss":0.00312,"percentile":0.24399}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/572991399"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121250","description":"Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121250","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121250","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121250","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121250","date":"2026-11-12","epss":0.00312,"percentile":0.24399}],"risk":0.29016,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121250","description":"Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121250","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121250","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121250","date":"2026-11-12","epss":0.00312,"percentile":0.24399}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/572991399"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121250","description":"Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121250","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121250","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121250","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121250","date":"2026-11-12","epss":0.00312,"percentile":0.24399}],"risk":0.29016,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121250","description":"Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121250","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121250","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121250","date":"2026-11-12","epss":0.00312,"percentile":0.24399}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/572991399"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121250","description":"Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121250","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121250","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121250","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121250","date":"2026-11-12","epss":0.00312,"percentile":0.24399}],"risk":0.29016,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121250","description":"Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121250","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121250","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121250","date":"2026-11-12","epss":0.00312,"percentile":0.24399}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/572991399"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121250","description":"Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121250","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121250","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121250","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121250","date":"2026-11-12","epss":0.00312,"percentile":0.24399}],"risk":0.29016,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121250","description":"Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121250","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121250","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121250","date":"2026-11-12","epss":0.00312,"percentile":0.24399}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/572991399"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121250","description":"Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-61915","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-61915","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61915","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-61915","cwe":"CWE-129","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-61915","date":"2026-11-12","epss":0.00496,"percentile":0.4306}],"risk":0.29016,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-61915","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15."},"relatedVulnerabilities":[{"id":"CVE-2025-61915","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6,"impactScore":4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61915","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-61915","cwe":"CWE-129","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-61915","date":"2026-11-12","epss":0.00496,"percentile":0.4306}],"urls":["https://github.com/OpenPrinting/cups/commit/db8d560262c22a21ee1e55dfd62fa98d9359bcb0","https://github.com/OpenPrinting/cups/releases/tag/v2.4.15","https://github.com/OpenPrinting/cups/security/advisories/GHSA-hxm8-vfpq-jrfc","http://www.openwall.com/lists/oss-security/2025/11/27/5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61915","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15."}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121047","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121047","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121047","date":"2026-11-12","epss":0.00356,"percentile":0.29754}],"risk":0.29014,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121047","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121047","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121047","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121047","date":"2026-11-12","epss":0.00356,"percentile":0.29754}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566251701"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121047","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121047","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121047","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121047","date":"2026-11-12","epss":0.00356,"percentile":0.29754}],"risk":0.29014,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121047","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121047","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121047","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121047","date":"2026-11-12","epss":0.00356,"percentile":0.29754}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566251701"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121047","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121047","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121047","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121047","date":"2026-11-12","epss":0.00356,"percentile":0.29754}],"risk":0.29014,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121047","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121047","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121047","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121047","date":"2026-11-12","epss":0.00356,"percentile":0.29754}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566251701"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121047","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121047","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121047","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121047","date":"2026-11-12","epss":0.00356,"percentile":0.29754}],"risk":0.29014,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121047","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121047","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121047","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121047","date":"2026-11-12","epss":0.00356,"percentile":0.29754}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566251701"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121047","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121047","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121047","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121047","date":"2026-11-12","epss":0.00356,"percentile":0.29754}],"risk":0.29014,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121047","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121047","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121047","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121047","date":"2026-11-12","epss":0.00356,"percentile":0.29754}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/566251701"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121047","description":"Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121113","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121113","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121113","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121113","date":"2026-11-12","epss":0.00353,"percentile":0.29349}],"risk":0.28769500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121113","description":"Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121113","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121113","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121113","date":"2026-11-12","epss":0.00353,"percentile":0.29349}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567106301"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121113","description":"Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121113","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121113","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121113","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121113","date":"2026-11-12","epss":0.00353,"percentile":0.29349}],"risk":0.28769500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121113","description":"Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121113","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121113","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121113","date":"2026-11-12","epss":0.00353,"percentile":0.29349}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567106301"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121113","description":"Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121113","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121113","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121113","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121113","date":"2026-11-12","epss":0.00353,"percentile":0.29349}],"risk":0.28769500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121113","description":"Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121113","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121113","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121113","date":"2026-11-12","epss":0.00353,"percentile":0.29349}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567106301"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121113","description":"Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121113","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121113","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121113","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121113","date":"2026-11-12","epss":0.00353,"percentile":0.29349}],"risk":0.28769500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121113","description":"Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121113","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121113","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121113","date":"2026-11-12","epss":0.00353,"percentile":0.29349}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567106301"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121113","description":"Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121113","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121113","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121113","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121113","date":"2026-11-12","epss":0.00353,"percentile":0.29349}],"risk":0.28769500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121113","description":"Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121113","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121113","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121113","date":"2026-11-12","epss":0.00353,"percentile":0.29349}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567106301"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121113","description":"Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121179","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121179","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121179","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121179","date":"2026-11-12","epss":0.0035,"percentile":0.29105}],"risk":0.28525000000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121179","description":"Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121179","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121179","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121179","date":"2026-11-12","epss":0.0035,"percentile":0.29105}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936263"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121179","description":"Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121179","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121179","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121179","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121179","date":"2026-11-12","epss":0.0035,"percentile":0.29105}],"risk":0.28525000000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121179","description":"Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121179","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121179","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121179","date":"2026-11-12","epss":0.0035,"percentile":0.29105}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936263"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121179","description":"Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121179","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121179","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121179","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121179","date":"2026-11-12","epss":0.0035,"percentile":0.29105}],"risk":0.28525000000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121179","description":"Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121179","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121179","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121179","date":"2026-11-12","epss":0.0035,"percentile":0.29105}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936263"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121179","description":"Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121179","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121179","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121179","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121179","date":"2026-11-12","epss":0.0035,"percentile":0.29105}],"risk":0.28525000000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121179","description":"Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121179","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121179","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121179","date":"2026-11-12","epss":0.0035,"percentile":0.29105}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936263"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121179","description":"Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121179","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121179","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121179","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121179","date":"2026-11-12","epss":0.0035,"percentile":0.29105}],"risk":0.28525000000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121179","description":"Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121179","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121179","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121179","date":"2026-11-12","epss":0.0035,"percentile":0.29105}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/567936263"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121179","description":"Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121112","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121112","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121112","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121112","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121112","description":"Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121112","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121112","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121112","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/40063728"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121112","description":"Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121178","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121178","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121178","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121178","description":"Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121178","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121178","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121178","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570029317"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121178","description":"Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121112","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121112","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121112","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121112","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121112","description":"Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121112","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121112","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121112","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/40063728"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121112","description":"Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121178","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121178","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121178","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121178","description":"Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121178","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121178","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121178","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570029317"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121178","description":"Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121112","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121112","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121112","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121112","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121112","description":"Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121112","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121112","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121112","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/40063728"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121112","description":"Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121178","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121178","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121178","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121178","description":"Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121178","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121178","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121178","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570029317"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121178","description":"Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121112","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121112","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121112","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121112","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121112","description":"Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121112","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121112","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121112","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/40063728"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121112","description":"Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121178","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121178","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121178","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121178","description":"Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121178","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121178","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121178","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570029317"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121178","description":"Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121112","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121112","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121112","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121112","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121112","description":"Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121112","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121112","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121112","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/40063728"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121112","description":"Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121178","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121178","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121178","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121178","description":"Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121178","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121178","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121178","date":"2026-11-12","epss":0.00361,"percentile":0.30344}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/570029317"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121178","description":"Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121140","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121140","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121140","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121140","date":"2026-11-12","epss":0.00361,"percentile":0.30343}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121140","description":"Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121140","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121140","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121140","date":"2026-11-12","epss":0.00361,"percentile":0.30343}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/557605839"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121140","description":"Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"eca4c79a3d59bf3c","cpes":["cpe:2.3:a:chromium-common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-common.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121140","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121140","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121140","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121140","date":"2026-11-12","epss":0.00361,"percentile":0.30343}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121140","description":"Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121140","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121140","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121140","date":"2026-11-12","epss":0.00361,"percentile":0.30343}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/557605839"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121140","description":"Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"38269f1fcb415403","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121140","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121140","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121140","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121140","date":"2026-11-12","epss":0.00361,"percentile":0.30343}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121140","description":"Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121140","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121140","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121140","date":"2026-11-12","epss":0.00361,"percentile":0.30343}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/557605839"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121140","description":"Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"e5414d3d8c97cbb5","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121140","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121140","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121140","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121140","date":"2026-11-12","epss":0.00361,"percentile":0.30343}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121140","description":"Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121140","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121140","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121140","date":"2026-11-12","epss":0.00361,"percentile":0.30343}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/557605839"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121140","description":"Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"ca4f943b4116b746","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-121140","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121140","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121140","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121140","date":"2026-11-12","epss":0.00361,"percentile":0.30343}],"risk":0.28519,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121140","description":"Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-121140","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121140","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121140","date":"2026-11-12","epss":0.00361,"percentile":0.30343}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/557605839"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121140","description":"Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"85468b25ed2dec2f","cpes":["cpe:2.3:a:chromium:chromium:156.0.8078.79-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@156.0.8078.79-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"156.0.8078.79-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:c803dd49640b452c4e9e74a5c98bf34811b704fc3257e85a50e4cef32bdff651","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-121183","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"156.0.8078.79-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-121183","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121183","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121183","date":"2026-11-12","epss":0.00348,"percentile":0.28795}],"risk":0.27492000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-121183","description":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-121183","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-121183","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-121183","date":"2026-11-12","epss":0.00348,"percentile":0.28795}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/550245671"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-121183","description":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]}],"grade":"F","score":"0.00","as_of":"2026-11-14T08:38:30.396Z","grype_db_version":"2026-11-13T15:40:34.000Z"}