Google Chrome CVE-2026-121076

Exploitation requires the victim to open attacker-controlled crafted HTML in an unpatched Chrome build (before 157.0.8103.38) and to exercise the WebXR code path that contains the use-after-free; the description explicitly frames this as 'leveraging social engineering,' so success depends on convincing the user to visit/interact with the page (UI:R). No authentication or prior privilege is needed (PR:N) and the flaw is reachable over the network against default Chrome installations, but the mandatory user interaction and the specific WebXR trigger are the practical limiting factors. The precise memory-corruption trigger within WebXR is not described in the available sources. The only complete fix stated by the vendor is updating to Chrome 157.0.8103.38 or later.

This is a genuine high-priority issue, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) describes a network-reachable, low-complexity, unauthenticated use-after-free in Chrome's WebXR component that achieves a sandbox escape (S:C) with full confidentiality, integrity and availability impact - i.e. arbitrary code execution OUTSIDE the renderer sandbox, which is the most severe outcome class for a browser bug. The only brake on the vector is UI:R: the victim must be convinced (social engineering) to open a crafted page, so exploitation is not fully drive-by/wormable. The vuln.today decision label is 'act_now', reinforcing treat-as-urgent. Counter-signals: this CVE is NOT listed in CISA KEV, no EPSS score was provided, and no public exploit or proof-of-concept is referenced (the Chromium issue tracker link is the vendor bug record, typically access-restricted, not exploit code). So the high urgency rests on severity and vendor priority rather than confirmed in-the-wild exploitation. EPSS is missing and cannot be weighed. Net: patch on an emergency cadence given the RCE-outside-sandbox impact and act_now label, while recognizing that active exploitation is not confirmed by the available data.

An attacker lures a victim running an unpatched Chrome (prior to 157.0.8103.38) to a malicious web page via social engineering (phishing link, malvertising, compromised site). The page serves crafted HTML that drives Chrome's WebXR code into a use-after-free condition, which the attacker leverages to execute arbitrary code outside the browser sandbox on the victim's host. No authentication is needed (PR:N), but the attack depends on the victim opening the page (UI:R); no public exploit code is identified at time of analysis.