Google Chrome Mobile CVE-2026-121077

Exploitation requires a victim running Google Chrome Mobile prior to 157.0.8103.38 to be socially engineered into opening an attacker-controlled crafted HTML page (UI:R); it is not drive-by against a passive target without that interaction. No authentication is required (PR:N) and the attack is remote over the network (AV:N). Limiting factors: the flaw is scoped to the Mobile build, success is described as only 'potential' arbitrary code execution outside the sandbox, and the user must be induced to load the malicious page. The specific object or feature that is freed and reused is not described in the available sources.

Severity signals conflict and must be read together. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields 9.6 Critical, driven by the scope change (S:C) that reflects code execution 'outside the sandbox' - a sandbox escape rather than a renderer-only bug. Yet Google's own Chromium security severity is rated Medium, a notable discrepancy that likely reflects the 'potentially' qualifier and the user-interaction requirement; verify the true impact against the Chrome advisory rather than treating 9.6 as settled. The vuln.today decision label is act_now and a vendor patch exists, which argues for prompt patching. Countervailing signals: exploitation requires user interaction via social engineering (UI:R), it affects the Mobile build specifically, and there is no public exploit identified at time of analysis. No EPSS score and no CISA KEV entry are present in the provided data, so there is no evidence of active exploitation or a measured exploitation probability - absence of these does not lower risk but means widespread automated exploitation is not currently indicated. Net: a genuine high-priority patching item because it is a memory-corruption sandbox-escape in a ubiquitous browser with a vendor fix available, tempered by the required user interaction and the unexplained CVSS-vs-vendor-severity gap.

An attacker lures a Chrome Mobile user, through social engineering, into visiting a web page containing crafted HTML that triggers a use-after-free in the browser. By grooming the freed object the attacker aims to corrupt memory and, per the description, potentially execute arbitrary code outside the sandbox on the device. No public exploit has been identified at time of analysis; the mechanism of the trigger beyond 'crafted HTML page' is not described in the available sources.