Google Chrome CVE-2026-121086

Exploitation requires a victim running Google Chrome prior to 157.0.8103.38 to load an attacker-controlled HTML page that triggers the heap buffer overflow in the Skia 2D graphics library (CVSS UI:R, PR:N) - this is the concrete prerequisite: delivery of crafted web content and the victim's act of visiting it. It works against default Chrome configurations with no authentication and no special feature toggle named in the sources. The primary limiting factor is the required user interaction (the victim must navigate to the malicious page, e.g. via phishing, malvertising, or a compromised site); a successful attack must also achieve the sandbox escape to reach code execution on the host, and auto-update to 157.0.8103.38 or later fully removes exposure.

This is a genuine high priority, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a remotely reachable, low-complexity, unauthenticated memory-corruption flaw whose scope change (S:C) reflects escape from the Chrome renderer sandbox to the host - the description's 'execute arbitrary code outside the sandbox' directly corroborates this scope change rather than contradicting it. The single mitigating metric is UI:R: the victim must load attacker-controlled content, so this is not wormable self-propagation. The vuln.today Decision label is act_now and patch availability is confirmed, which should drive remediation urgency. The signals are partly in tension: CISA's SSVC framework records Exploitation: none and Automatable: no (total Technical Impact), and there is no CISA KEV entry, no EPSS score in the input, and no PoC reference - so there is no evidence of active or automatable exploitation today. The combination to weight is severity-plus-reach plus near-universal deployment versus the absence of any exploitation signal and the user-interaction requirement. EPSS is missing and cannot be used as a tie-breaker here - that gap should be noted rather than filled with assumption. Net: patch urgently because of ubiquitous footprint, total technical impact, and sandbox-escape RCE, while recognizing exploitation is not yet observed.

An attacker hosts or injects a malicious web page containing content crafted to corrupt heap memory in Chrome's Skia graphics library; when a victim navigates to it, the overflow is triggered and arbitrary code executes outside the renderer sandbox on the victim's host. No public exploit code or PoC was identified in the provided sources, and the specific heap-grooming or trigger mechanism is not described in the available sources.