Google Chrome CVE-2026-121070

Exploitation requires the victim to load/render a crafted HTML page in a vulnerable Chrome build (any version prior to 157.0.8103.38) - this is the UI:R user-interaction requirement and the primary limiting factor. No authentication is required (PR:N in the supplied vector). The key impact limiter is that arbitrary code execution is confined to the renderer sandbox per the vendor description, so achieving code execution on the host requires chaining a separate sandbox-escape vulnerability - this bug alone does not yield host compromise. No special non-default configuration is indicated; standard browsing of attacker-controlled content is sufficient to reach the vulnerable WTF code path.

Signals are moderately consistent but point to a lower real-world priority than the raw score implies. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects a network-reachable, low-complexity, unauthenticated memory-corruption flaw (CWE-416 use-after-free) that nonetheless requires user interaction (UI:R). Critically, the NVD/vendor description states code execution occurs 'inside the sandbox' - meaning a successful exploit is confined to the Chrome renderer process and would need a separate sandbox-escape chain to achieve host compromise; the scope-unchanged (S:U) metric is consistent with this. Chromium itself rated the security severity only Medium, which is lower than the 8.8 base score and aligns with the sandbox-contained impact. SSVC reinforces a measured posture: Exploitation = none (no observed exploitation), Automatable = no (user must open a crafted page), Technical Impact = total. KEV status is not present in the input (so: no confirmed active exploitation), no EPSS score was provided, and no public exploit was supplied. The vuln.today decision label is 'this_week' rather than act_now/emergency. Net: a genuinely serious memory-corruption bug worth patching on a near-term (this-week) cadence given Chrome's enormous footprint, but not an emergency - the absence of exploitation signals, the required user interaction, and the sandbox containment all argue against widespread opportunistic compromise. Missing data to note: no EPSS and no KEV entry were provided, so exploitation-probability cannot be quantified from the input.

An attacker hosts or injects a crafted HTML page and lures a victim into visiting it with a vulnerable Chrome build (prior to 157.0.8103.38). Rendering the page triggers the use-after-free in Blink's WTF layer, letting the attacker execute arbitrary code within the renderer sandbox; full system control would require chaining an additional sandbox escape. No public exploit code was provided in the input, and the referenced Chromium issue (567611695) is a restricted bug tracker entry, not a working PoC.