Google Chrome CVE-2026-121060

Exploitation requires user interaction (UI:R): a victim must be socially engineered into opening an attacker-controlled crafted HTML page in a Chrome build prior to 157.0.8103.38. No authentication or prior privileges are required (PR:N), and the attack is delivered remotely over the network (AV:N). The limiting factors are the mandatory user action (visiting/opening the malicious page) and the requirement that the target run an unpatched Chrome version at or below the affected branch; fully patched installs (157.0.8103.38 and later) are not exploitable. The exact FileSystem configuration or feature state needed to trigger the incorrect authorization is not described in the available sources.

This is a genuine high-priority issue, not an inflated high-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, low-complexity, unauthenticated sandbox escape whose only gating factor is user interaction, and the scope change (S:C) is consistent with code executing outside the Chrome renderer sandbox on the host. The vuln.today decision label is 'act_now' and Google has shipped a fix, both of which reinforce urgency. However, key exploitation signals are absent: no EPSS probability is supplied, there is no CISA KEV entry in the input, and no confirmed public exploit - so exploitation likelihood cannot be quantified from the data provided. The signals are therefore not conflicting but incomplete: severity and vendor/priority signals are strong, while real-world exploitation signals (EPSS, KEV, working PoC) are simply missing rather than low. Treat the missing EPSS/KEV as unknowns to verify, not as evidence of low risk, given Chrome's ubiquity and the act_now label.

An attacker uses social engineering to lure a victim into opening a crafted HTML page in a vulnerable Chrome build; the page abuses an incorrect authorization check in the FileSystem component to break out of the renderer sandbox and run arbitrary code with the browser process's privileges on the host. No public exploit code is identified in the available data, and the precise trigger mechanism is not described in the sources beyond 'crafted HTML page.'