Google Chrome CVE-2026-121078

Exploitation requires the victim to load attacker-controlled web content in a vulnerable Chrome build prior to 157.0.8103.38 - this is reflected by UI:R in the CVSS vector, so it cannot be triggered without user interaction (visiting or being redirected to a crafted HTML page) and is marked Automatable='no' in SSVC. No special non-default configuration is named in the sources. The principal limiting factor is that, per the description, code execution is achieved 'inside the sandbox': the attacker gains execution in the renderer process only, and full host compromise would generally require chaining an additional sandbox-escape vulnerability. Affects the default V8 engine present in all standard Chrome installations below the fixed version.

This is a genuinely serious but not emergency-level issue, and the signals are mostly consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing no privileges but requiring user interaction (the victim must load a crafted HTML page). The SSVC decision framework tempers this: Exploitation is 'none' (no observed or proof-of-concept exploitation per the input), Automatable is 'no' (consistent with UI:R - attacks cannot be fully automated/wormed because a user must visit a page), and Technical Impact is 'total' (consistent with C:H/I:H/A:H arbitrary code execution). This CVE is NOT in CISA KEV and the SSVC exploitation status is 'none', so there is no evidence of active exploitation. No EPSS score was provided, so exploitation probability cannot be quantified. The vuln.today priority is 'this_week', which aligns with a high-severity browser RCE that is patched but not under active attack - a prompt-patch item, not a drop-everything emergency. Two signals warrant caution: the description explicitly scopes code execution to 'inside the sandbox', meaning a successful exploit still faces Chrome's renderer sandbox and would typically need a second sandbox-escape bug to achieve full host compromise - the CVSS C:H/I:H/A:H does not reflect that containment. The chromium issue reference (issues.chromium.org/578083257) is a tracker entry, not verified working exploit code.

A remote attacker hosts or compromises a web page containing crafted JavaScript that triggers the V8 type-confusion flaw; a victim using a vulnerable Chrome build simply visits the page and the attacker achieves arbitrary code execution within the renderer sandbox. No authentication is required, but the victim must load the malicious content (UI:R). No verified working exploit code is identified in the provided data - only a Chromium issue-tracker reference exists.