Google Chrome CVE-2026-121079

Exploitation requires the victim to open attacker-controlled web content in a vulnerable Google Chrome build earlier than 157.0.8103.38 - the crafted HTML page is the required delivery vector and user interaction (UI:R) is a hard prerequisite, so this is not a no-click bug. Code execution is confined to the browser sandbox (S:U), so this flaw by itself does not grant host-level access and would need to be combined with a separate sandbox-escape bug for full system compromise. No authentication is required (PR:N) and default Chrome configurations are affected; the limiting factors are the need for user interaction and the sandbox boundary. The exact conditions that win the race are not described in the available sources.

Signals are mixed and point to a serious-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H, 8.8) describes a network-reachable, unauthenticated flaw needing only that a victim load a crafted HTML page, which is why Google rates the Chromium security severity as High. However, the SSVC decision framework reports Exploitation: none and Automatable: no, and no CISA KEV listing is present, so there is no evidence of active exploitation; only the Technical Impact is rated total. No EPSS score was supplied, so exploitation probability cannot be quantified here. The vuln.today Decision label is 'this_week' rather than act_now/emergency, consistent with a patched, high-severity browser bug that is not yet known to be exploited. One important scope nuance: the description states code execution occurs 'inside the sandbox' (S:U), meaning this bug alone does not demonstrate a sandbox escape to the host OS and would typically need to be chained with a second bug for full system compromise - the C:H/I:H/A:H impacts apply within the renderer context. Net: a real, high-priority patch item on a ubiquitous product, but current data indicates no in-the-wild exploitation and non-automatable attacks, so it is urgent maintenance rather than a fire drill.

An attacker hosts or compromises a web page containing crafted content that triggers the V8 race condition; a victim using a vulnerable Chrome build (prior to 157.0.8103.38) simply visits the page (UI:R) and the attacker achieves arbitrary code execution within the browser sandbox. No public exploit has been identified at time of analysis, and the specific trigger mechanism for the race is not described in the available sources. Full host compromise would generally require chaining this with a separate sandbox-escape vulnerability.