Google Chrome CVE-2026-121034

Exploitation requires the victim to be running Google Chrome on Windows at a version prior to 157.0.8103.38 and to be induced via social engineering to open a crafted HTML page - this user interaction (UI:R) is the primary limiting factor, as the flaw is not triggered passively or automatically. No authentication or special privileges are needed (PR:N), and no non-default configuration is indicated; the bug resides in the Views component and achieves execution outside the sandbox. The practical limiter is therefore the need to get a user to visit attacker-controlled content; patched versions (157.0.8103.38 and later) are not affected.

This is a genuine high priority, not a high-CVSS-but-low-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction, and critically the scope is Changed (S:C) because the description explicitly states code executes OUTSIDE the Chrome sandbox - a full sandbox escape, which is the most severe class of browser bug. The vuln.today Decision label is act_now and a vendor patch is available, so remediation urgency is high. However, the exploitation signals are mixed and partially absent: no CISA KEV listing is present in the input, no EPSS probability was supplied, and no public exploit is referenced (the two chromium.googleblog/issues.chromium.org links are a vendor release note and an issue-tracker entry, not working exploit code). So active exploitation is NOT confirmed and should not be assumed; the act_now label here is driven by severity, sandbox-escape impact, and the UI-only barrier rather than by evidence of in-the-wild use. Net: treat as urgent to patch due to impact and act_now decision, while recognizing exploitation status is unproven from the available data.

A remote attacker uses social engineering (e.g. a lure to a malicious site or a deceptive link) to get a Windows Chrome user to open a crafted HTML page, which triggers the use-after-free in the Views component. Because the impact is code execution outside the sandbox, successful exploitation yields arbitrary code execution on the host with the user's privileges. No public exploit code is referenced in the available sources; the precise trigger mechanism is not described beyond 'crafted HTML page' plus required user interaction.