VSCodium 1.109.41146 – Why Updating for the Chromium CVE‑2026‑2441 Fix Matters
VSCodium 1.109.41146 drops on top of VS Code 1.109.4 and brings a back‑ported patch that closes Chrome’s CVE‑2026‑2441 flaw. The article explains what the vulnerability does, why the fix is worth installing, and how to verify you’re actually running the patched build.
What the CVE‑2026‑2441 bug actually did
Chromium’s issue let a malicious webpage inject code into the renderer process, which could then escape sandbox restrictions and execute arbitrary commands on the host. In VSCodium that translates to a potential remote‑code execution path when you open an untrusted HTML preview or use extensions that embed webviews. The exploit isn’t theoretical; a security researcher demonstrated it by crafting a specially‑encoded markdown file that launched a PowerShell script as soon as the preview pane rendered the content.
Verifying the update actually applied
After installing 1.109.41146, launch VSCodium and open the “Help => About” dialog. The version line should read VSCodium 1.109.41146 (commit …) and the build date will be within a day or two of the release. For an extra sanity check, run vscodium --version in PowerShell; the output includes the Chromium revision number, which now ends with the back‑ported commit hash.
Should you skip this update?
If your workflow never touches webviews, markdown previews, or extensions that embed remote content, you might feel safe staying on an older build. However, the patch is tiny—just a few lines of code—and it removes a whole attack surface without any performance penalty. In practice, installing the update costs a couple of minutes and saves you from a potential ransomware scenario.
Downloads
x86 64bits
ARM 64bits
ARM 32bits
PPC 64bits
| Linux | .tar.gz | VSCodium-linux-ppc64le-1.109.41146.tar.gz |
| Remote Host | vscodium-reh-linux-ppc64le-1.109.41146.tar.gz | |
| Web Host | vscodium-reh-web-linux-ppc64le-1.109.41146.tar.gz |
RISC-V 64bits
| Linux | .tar.gz | VSCodium-linux-riscv64-1.109.41146.tar.gz |
| Remote Host | vscodium-reh-linux-riscv64-1.109.41146.tar.gz | |
| Web Host | vscodium-reh-web-linux-riscv64-1.109.41146.tar.gz |
Loong 64bits
| Linux | .tar.gz | VSCodium-linux-loong64-1.109.41146.tar.gz |
| Remote Host | vscodium-reh-linux-loong64-1.109.41146.tar.gz | |
| Web Host | vscodium-reh-web-linux-loong64-1.109.41146.tar.gz |
s390x
| Linux | Remote Host | vscodium-reh-linux-s390x-1.109.41146.tar.gz |
| Web Host | vscodium-reh-web-linux-s390x-1.109.41146.tar.gz |
