Google Chrome CVE-2026-121036

Exploitation requires a victim to open an attacker-controlled HTML page containing crafted CSS (UI:R) - no authentication and no special Chrome configuration are needed, so default installations of Google Chrome prior to 157.0.8103.38 are affected. The key limiting factor is that code execution is confined to the renderer sandbox per the vendor description; achieving code execution on the host requires chaining a separate sandbox-escape vulnerability. Exploitation is also non-automatable (SSVC Automatable: no) because each target must individually be lured to the malicious page.

This is a genuine high-priority browser vulnerability but not an immediate emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) scores 8.8 and indicates a remote, low-complexity, unauthenticated attack requiring only that a victim visit a crafted HTML page - the classic drive-by profile for a renderer use-after-free (CWE-416). However, two signals temper the raw score: the description explicitly states code execution occurs 'inside the sandbox,' meaning a successful attack yields renderer-level compromise and still requires a separate sandbox-escape chain to reach the host, and the SSVC framework records Exploitation: none and Automatable: no (consistent with UI:R, since each target must be lured to a page). SSVC Technical Impact: total aligns with the C:H/I:H/A:H impact within the renderer context. No CISA KEV listing and no public exploit were provided, so there is no evidence of active exploitation. EPSS is not supplied in the input, so exploitation probability cannot be quantified here. The vuln.today Decision label is 'this_week,' which matches the overall picture: patch promptly within the normal urgent cadence rather than treating it as an active-exploitation emergency. The 'Denial Of Service' tag is plausible as a secondary outcome of a UAF but the primary documented impact is sandboxed code execution.

An attacker hosts or compromises a web page containing crafted CSS that triggers the use-after-free in Chrome's CSS handling, then lures a victim to open it (malvertising, phishing link, or a watering-hole site). When the victim's browser renders the page, the freed object is reused to achieve arbitrary code execution within the renderer sandbox. No public exploit was identified in the provided data, and full host compromise would require chaining an additional sandbox escape.