Google Chrome CVE-2026-121030

Exploitation requires social engineering plus user interaction (UI:R): the victim must open and interact with an attacker-crafted HTML page that abuses an incorrect-authorization condition in Chrome's DevTools, after which code can execute outside the renderer sandbox (scope change, Technical Impact: total). The precise DevTools feature state or interaction that triggers the authorization failure is not described in the available sources. Key limiting factors: the attack is not automatable (SSVC Automatable: no), depends entirely on luring a user into the required interaction rather than silent drive-by compromise, and affects Chrome builds prior to 157.0.8103.38 - updated installs are not vulnerable. No authentication is required (PR:N), so this is remote and unauthenticated, but gated by mandatory user interaction.

The signals here diverge sharply and must be weighed against each other. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields 9.6, driven largely by the scope change (S:C) that reflects a sandbox escape and by total C/I/A impact - yet Google's own Chromium security team rated this only 'Medium', and the SSVC framework records Exploitation: none and Automatable: no. The high CVSS is therefore a worst-case severity rating, not evidence of imminent mass exploitation; UI:R plus 'leveraging social engineering' means a victim must be actively lured into interacting with attacker content, and SSVC 'Automatable: no' confirms this cannot be driven at scale. There is no KEV listing and no EPSS score in the supplied data, so exploitation probability cannot be quantified from these inputs; exploitation status is 'no public exploit identified at time of analysis.' The one strong urgency signal is the vuln.today Decision label of act_now, which - combined with Technical Impact: total (full sandbox escape to arbitrary code execution) and Chrome's ubiquity - justifies prompt patching. Net assessment: a genuinely high-impact sandbox-escape bug whose real-world risk is tempered by the required user interaction and absence of known exploitation, but the act_now decision and ubiquitous footprint mean it should be patched without delay rather than deferred. Note the internal severity conflict (CVSS 9.6 vs Chromium 'Medium') - verify prioritization against the vendor advisory.

An attacker crafts a malicious HTML page and uses social engineering (phishing link, deceptive site) to convince a Chrome user to open it and perform the triggering interaction. The page abuses the incorrect authorization flaw in DevTools to break out of the renderer sandbox and execute arbitrary code on the host. No public exploit code is identified in the available data, and SSVC records no known exploitation.