Google Chrome CVE-2026-121123

Exploitation requires a victim running an unpatched Google Chrome build prior to 157.0.8103.38 to load an attacker-crafted HTML page that triggers the use-after-free in the Canvas component (UI:R - the user must open attacker-controlled content such as a malicious link, site, or ad). No authentication is required (PR:N). The key limiting factor is that the resulting code execution is explicitly confined 'inside the sandbox' (renderer process); full host compromise would require an additional, separate sandbox-escape vulnerability not covered by this CVE. There is no indication of a non-default configuration requirement - the flaw applies to standard Chrome rendering of web content.

Signals are moderately consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction, with high impact to confidentiality, integrity and availability but no scope change - the unchanged scope (S:U) is important because the description states code executes only 'inside the sandbox', so impact is contained to the renderer process absent a separate sandbox escape. The SSVC framework reinforces a measured posture: Exploitation=none (no observed or public exploitation), Automatable=no (user interaction is needed), and Technical Impact=total (full compromise of the affected renderer component). This aligns with the vuln.today Decision label of 'this_week' rather than act_now/emergency. KEV status is not present, so there is no confirmed active exploitation, and no EPSS score was supplied in the input, so exploitation probability cannot be quantified here - this is a data gap, not a low score. No verified public exploit code is provided; the Chromium issue tracker link is a (typically access-restricted) bug reference, not working exploit code. Net: a genuine high-severity memory-corruption bug in an ubiquitous product warranting prompt patching, but the required user interaction, sandbox containment, and absence of KEV/known exploitation argue against treating it as an active in-the-wild emergency.

A remote attacker hosts or injects a crafted HTML page that drives the Canvas component into a use-after-free condition; when a victim using an unpatched Chrome build visits the page, the attacker achieves arbitrary code execution within the browser's renderer sandbox. No public exploit is identified at time of analysis, and because the vector is AV:N/AC:L but UI:R, the attack requires the victim to open attacker-controlled content (e.g., via a link or malicious ad).