Google Chrome: use after free in Aura (CVE-2026-121178)
CVE-2026-121178 (CVSS 8.3) has been published for the Aura component in Google Chrome. Chromium rates it High. An attacker who has already compromised the renderer process could use a crafted HTML page to execute code outside the sandbox.
Checked in Shield: no
Who is affected
Google Chrome versions prior to 157.0.8103.38. For the chromium package on servers, the version mapping is not stated in the source.
How to check
Open chrome://version and compare the version with 157.0.8103.38. For chromium on a server, check the CVE status in the Debian security tracker.
How to fix
A fix is available in Chrome 157.0.8103.38 and later. Update the browser. If chromium on a server handles untrusted content, update it once a patch is released; if it is not needed, consider removing the package.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the issue is exploited in the wild is not disclosed yet. Source: NVD, CVE-2026-121178.
