Google Chrome CVE-2026-121126

Exploitation requires the victim to load attacker-controlled crafted HTML in Chrome (the UI:R / user-interaction requirement - visiting or being redirected to a malicious page); no authentication or prior privileges are needed (PR:N). The vulnerability resides in the Core component and, per the description, can lead to code execution outside the sandbox, meaning a successful trigger is not contained to the renderer. The primary limiting factors are the required user interaction (the victim must open a page) and version: only Chrome builds prior to 157.0.8103.38 are affected, so updated installations are not exploitable. No non-default configuration or special feature toggle is cited in the available sources, and the precise memory-management trigger is not described in the input beyond the use-after-free classification.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) indicates a network-reachable, low-complexity flaw requiring no privileges, only that the victim load a page, with a scope change reflecting the description's explicit claim of code execution 'outside the sandbox' - a full sandbox escape, which is the most severe class of browser bug. Google's own 'Critical' Chromium severity rating and the vuln.today 'act_now' decision label both reinforce urgency. However, the signals are not uniformly alarming: the SSVC decision framework reports Exploitation: none (no observed or public exploitation), Automatable: no, and Technical Impact: total, so the 'act_now' urgency is driven by the critical technical impact and the breadth of Chrome's deployment rather than by confirmed exploitation. No EPSS score and no CISA KEV status were provided in the input, and no confirmed proof-of-concept is present (the Chromium issue-tracker reference is an access-restricted bug entry, not published exploit code). Net assessment: treat as urgent and patch immediately given ubiquity, critical impact, and act_now labeling, while noting that there is no evidence of active exploitation at time of analysis.

A remote attacker hosts or compromises a web page containing crafted HTML that triggers the use-after-free in Chrome's Core component when a victim visits it. Because the flaw permits code execution outside the renderer sandbox, successful exploitation could yield arbitrary code execution on the host with the browser user's privileges. No public exploit code was identified in the provided data; the referenced Chromium issue is a restricted bug report, not verified working exploit code.