Google Chrome CVE-2026-121083

Exploitation requires the victim to open an attacker-controlled crafted HTML page in Chrome (CVSS UI:R) - there is no server-side or passive trigger. No authentication or prior privileges are needed (PR:N), and the flaw is reachable against default Chrome configurations prior to 157.0.8103.38 with no special feature or configuration prerequisite named in the description. The principal limiting factor is that resulting code execution is confined to the renderer sandbox, so impactful host compromise additionally requires a separate sandbox-escape not covered by this CVE; the specific object lifecycle and trigger within the Compositing component is not described in the available sources.

This is a genuine high-priority patch item, though not an emergency. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction - the victim must open a crafted HTML page. The SSVC framework confirms Technical Impact: total but Exploitation: none and Automatable: no, and there is no CISA KEV listing, so there is no evidence of active exploitation at this time. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. The references include a Chromium issue-tracker entry (issues.chromium.org/567321055), which is typically access-restricted and is NOT verified as working exploit code; combined with the absence of any KEV/POC confirmation, this points to a patched, responsibly-disclosed bug rather than one under broad attack. One important caveat the description states explicitly: code execution occurs INSIDE the sandbox, meaning a successful exploit alone does not yield host compromise without an additional sandbox-escape - this materially tempers real-world severity relative to the raw 8.8. The vuln.today decision label is 'this_week', consistent with a serious but not actively-exploited memory-corruption flaw in ubiquitous software.

A remote attacker hosts or injects a crafted HTML page that triggers a use-after-free in Chrome's Compositing component when a victim visits it (UI:R / crafted HTML page). Successful exploitation yields arbitrary code execution confined to the renderer sandbox, which would then require a separate sandbox-escape to affect the host. No public, verified exploit code is identified at the time of analysis; a restricted Chromium issue reference exists but is not confirmed working exploit code.