Google Chrome CVE-2026-121089

Exploitation requires a victim using Google Chrome prior to 157.0.8103.38 to load an attacker-controlled HTML page that exercises the WebGPU API (WebGPU is enabled by default in current Chrome on supported GPUs/platforms). The precise object-lifetime trigger for the use-after-free is not described in the available sources. The main limiting factor is the required user interaction (UI:R) - the victim must navigate to or be redirected into the malicious page; there is no authentication requirement (PR:N). Realistic risk is further bounded by SSVC Automatable:'no,' meaning the user-interaction dependency impedes fully automated mass exploitation.

This is a genuine high-priority issue, not an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim open a crafted page, with a scope change reflecting the sandbox escape - consistent with the description's claim of code execution 'outside the sandbox.' The vuln.today Decision label is act_now and the vendor has shipped a fix, both arguing for urgent patching. However, the signals are not uniformly alarming: CISA SSVC lists Exploitation as 'none' (no observed exploitation) and Automatable as 'no' (user interaction breaks mass automation), while Technical Impact is 'total.' This CVE is NOT in CISA KEV, and no EPSS score was provided, so the real-world exploitation probability cannot be quantified from the input. In short: maximal technical impact and easy reachability, but no evidence of active exploitation yet - treat as a near-term patch priority driven by impact and the act_now label rather than by confirmed in-the-wild activity.

An attacker hosts a malicious web page containing crafted WebGPU content and lures a victim into visiting it (the CVSS vector requires user interaction, UI:R). Rendering the page triggers a use-after-free in Chrome's WebGPU implementation, which the attacker leverages to execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the referenced Chromium issue tracker entry is a bug record, not working exploit code.