Google Chrome CVE-2026-121048

Exploitation requires the victim to open an attacker-controlled HTML page in a vulnerable Chrome build prior to 157.0.8103.38 (CVSS UI:R, PR:N - remote, no authentication). The key limiting factor is sandbox containment: the description states code executes 'inside the sandbox', so this flaw alone yields code execution only within the renderer process, not on the underlying host - a separate sandbox-escape vulnerability would be needed for full system compromise. No non-default configuration is required; standard Chrome browsing of web content is the attack surface.

Signals are mixed and must be weighed carefully. The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) reflects a remotely reachable, unauthenticated flaw needing only that the victim open a page, with high impact to confidentiality, integrity and availability. However, the vendor (Google/Chromium) rated this 'Medium' severity, and the description explicitly scopes the outcome to 'execute arbitrary code inside the sandbox' - i.e. code runs within the renderer sandbox, not on the host, so the 8.8 numeric score overstates real-world impact unless chained with a separate sandbox-escape bug. No EPSS score was provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no confirmed public exploit code - only a vendor advisory and a (restricted) Chromium issue-tracker reference. The vuln.today decision label is 'this_week', consistent with a patched browser bug of elevated but not emergency urgency. Net: this is a genuine priority to patch on a normal browser-update cadence (this week), but the gap between the CVSS 8.8 and the vendor 'Medium' rating is driven by sandbox containment - verify that your fleet is updated rather than treating it as an unauthenticated full-host RCE.

A remote attacker hosts a crafted HTML/JavaScript page and lures a victim running a vulnerable Chrome build (prior to 157.0.8103.38) to visit it. The page triggers the race condition in the V8 engine, leading to arbitrary code execution confined to the renderer sandbox; full host compromise would require chaining a separate sandbox-escape vulnerability. No special privileges are needed, but the victim must open the page (UI:R); no verified public exploit code is identified at time of analysis.