Google Chrome: DevTools reference flaw (CVE-2026-121200)
CVE-2026-121200 has been published: incorrect reference resolution in DevTools in Google Chrome. An attacker using social engineering and a crafted HTML page could potentially execute arbitrary code outside the sandbox.
Checked in Shield: no
Who is affected
Google Chrome versions prior to 157.0.8103.38. Chromium rates the severity as Medium, while the NVD CVSS score is 9.6. Social engineering is required, meaning user interaction.
How to check
Open chrome://version and compare the version with 157.0.8103.38. On a server, check whether chromium is installed (for example, apt policy chromium) and whether it runs with untrusted content.
How to fix
Fixed in Chrome 157.0.8103.38 and later. The fixed version of the Debian chromium package is not disclosed yet. Watch Debian security and update when it is released. If Chromium is not needed, remove it.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the flaw is exploited in the wild is not disclosed yet. Source: NVD entry for CVE-2026-121200.
