Google Chrome CVE-2026-121114

Exploitation requires the victim to load attacker-controlled web content in a vulnerable Chrome desktop build prior to 157.0.8103.38 (CVSS UI:R) - i.e. the user must open or be navigated to a crafted HTML page; no authentication and no special Chrome configuration are required, and default configurations are affected. The limiting factor is this required user interaction (visiting the malicious page) rather than any non-default setting. Because the flaw escapes the renderer sandbox (S:C), successful exploitation yields execution outside the sandboxed process; the exact object-lifetime trigger in TabStrip is not described in the available sources.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a remote, low-complexity, unauthenticated use-after-free whose scope change (S:C) and 'outside the sandbox' language indicate a full sandbox escape - meaning code execution reaching beyond the Chromium renderer into the host context, which is why technical impact is rated total. The signals are partly in tension and this must be stated plainly: the vuln.today Decision label is act_now and the vendor patched it in a Stable channel update, yet CISA SSVC records Exploitation: none and Automatable: no, and there is no CISA KEV listing and no EPSS score supplied. No working exploit or PoC is present in the references (only the vendor release blog, a restricted Chromium issue tracker entry, and the NVD/EUVD mirror). The net picture: maximal technical impact and trivial delivery (a crafted web page), but no evidence yet of in-the-wild exploitation or automation - the urgency comes from the act_now priority and the severity of a sandbox-escaping UAF in a ubiquitous browser, not from confirmed active exploitation. EPSS is absent, so exploitation probability cannot be quantified from the input.

An attacker hosts or injects a crafted HTML page and lures a victim into visiting it with a vulnerable Chrome build (prior to 157.0.8103.38); rendering the page triggers the TabStrip use-after-free and executes attacker code outside the renderer sandbox. The precise trigger sequence is not described in the available sources. No public exploit identified at time of analysis - the references contain only vendor advisories and a restricted Chromium issue, not working exploit code.