Google Chrome CVE-2026-121071

Exploitation requires the victim to open a crafted HTML page in Google Chrome prior to 157.0.8103.38, reached through social engineering - this maps to the CVSS UI:R and is the primary limiting factor, meaning there is no remote, interaction-free exploitation and (per SSVC) it is not automatable at scale. No authentication is required (PR:N), and the trigger is an attacker-controlled web page served to the browser; beyond the requirement to visit the malicious page, the advisory describes no non-default configuration or feature toggle. The specific internal mechanism of the incorrect authorization in the FileSystem component is not described in the available sources; only that it permits code execution outside the sandbox.

Signals are strong but partially conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, low-complexity, unauthenticated sandbox escape whose only gating factor is user interaction, and SSVC rates Technical Impact as 'total' - consistent with arbitrary code execution outside the Chrome sandbox. The vuln.today Decision label is act_now and a vendor patch is available, which argues for prompt patching. However, the exploitation-maturity signals do NOT indicate active abuse: SSVC Exploitation is 'none', the CVE is not in CISA KEV, and no EPSS score was supplied. No working exploit code is referenced (the issues.chromium.org link is a restricted bug-tracker entry, not a published PoC). SSVC also marks Automatable 'no', consistent with the UI:R requirement that each victim must be socially engineered into opening a crafted page. Net: a genuinely high-severity, patch-now browser flaw by impact and the act_now label, but currently no evidence of in-the-wild exploitation - urgency is driven by potential total impact and the act_now decision, not by observed attacks. Missing data to note: no EPSS probability provided, and exploitation status is 'none', so the act_now label reflects severity/impact rather than confirmed exploitation.

An attacker crafts a malicious HTML page that abuses the incorrect authorization in Chrome's FileSystem component and uses social engineering (phishing link, malicious ad, or lure) to get a victim to open it in an unpatched Chrome build before 157.0.8103.38. When the page is loaded, the flaw lets attacker-controlled code break out of the renderer sandbox and run with the browser process's privileges on the host. No public exploit code is identified at time of analysis.