Google Chrome CVE-2026-121074

Exploitation requires the victim to open an attacker-controlled crafted HTML page in Google Chrome for Android on a version prior to 157.0.8103.38 (UI:R). No authentication is required (PR:N) and the attack is network-delivered against default Chrome installations. The limiting factors are: mandatory user interaction (the victim must navigate to the malicious page), the attack targets the Android build specifically, and only versions below 157.0.8103.38 are affected. Because the memory corruption is in the GPU process and the impact is a sandbox escape (S:C), successful exploitation yields code execution on the host beyond Chrome's sandbox; the exact triggering condition within the GPU process is not described in the available sources.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) describes network-reachable, low-complexity, unauthenticated code execution that escapes the Chrome renderer/GPU sandbox (scope change S:C) with total confidentiality, integrity and availability impact - consistent with the description of memory corruption in the GPU process leading to code execution outside the sandbox. The only brake is UI:R: a victim must open a crafted HTML page. The vuln.today decision label is act_now and the SSVC Technical Impact is 'total', reinforcing urgency. However, the signals are not all pointing to imminent mass exploitation: SSVC Exploitation is 'none' (so this is NOT in CISA KEV), SSVC Automatable is 'no', and no EPSS score was supplied. In short, severity and potential impact are very high and a patch is available, but there is no evidence of active exploitation or public exploit code at this time - treat as urgent patching driven by impact and product ubiquity rather than by confirmed in-the-wild activity.

An attacker lures an Android user to a malicious or compromised web page (via link, ad, or injected content); the page delivers crafted content that triggers memory corruption in Chrome's GPU process, and the attacker leverages it to execute arbitrary code outside the browser sandbox on the device. No public exploit code has been identified at time of analysis, and successful attack requires the victim to actually open the page.