Google Chrome CVE-2026-121094

Exploitation requires the victim to load attacker-controlled HTML/JavaScript in Chrome (CVSS UI:R) - e.g. visiting a malicious site or a page carrying injected script - against any unpatched build prior to 157.0.8103.38 in its default configuration; no authentication or special settings are needed (PR:N). The principal limiting factors are (1) required user interaction, so the attacker must lure the target to the page, and (2) the impact is confined to the renderer sandbox (S:U), meaning this flaw alone does not grant host-level or cross-origin control without an additional sandbox-escape chain. Updating to Chrome 157.0.8103.38 or later is the vendor-provided fix.

Signals are mostly consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (visiting a crafted page) and does NOT cross a privilege/scope boundary - the description explicitly confines code execution to the renderer sandbox (S:U). SSVC reinforces a measured posture: Exploitation=none (no observed exploitation), Automatable=no (user must be lured to a page, so it does not mass-scan/worm cleanly), but Technical Impact=total (full control of the compromised renderer). There is no CISA KEV listing and no public exploit identified - the issues.chromium.org reference is a restricted Chromium bug-tracker entry, not published exploit code. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be cited here. The vuln.today decision label is 'this_week', aligning with a promptly-patchable, high-impact browser bug rather than an act_now/emergency item. Bottom line: a genuine priority for any Chrome fleet given ubiquity and total renderer impact, but tempered by required user interaction, no sandbox escape in the described impact, and no evidence of in-the-wild exploitation at analysis time.

An attacker hosts a malicious web page (or injects malicious script into a page the victim trusts) that drives V8 into a type-confusion state when the victim's Chrome renders it. Because attack complexity is low but user interaction is required, the victim must be lured to open the page; success yields arbitrary code execution confined to the renderer sandbox. No public exploit identified at time of analysis, and no in-the-wild exploitation is reported.