Google Chrome CVE-2026-121127

Exploitation requires a victim using an affected desktop Google Chrome build (prior to 157.0.8103.38) to load attacker-controlled HTML that exercises the WebAudio API - this user interaction (UI:R) is the key limiting factor, as the victim must navigate to or render the crafted page; it cannot be triggered purely server-side without that interaction. No authentication is required (PR:N) and no special non-default Chrome configuration is indicated by the description - WebAudio is a standard built-in browser capability. The most significant limiter on real-world impact is that successful code execution is confined to the renderer sandbox (S:U); escaping to the host would require chaining an additional sandbox-escape vulnerability, which is not part of this CVE.

This is a genuine high-priority patch item, though not an active-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated (PR:N) memory-corruption flaw that requires one piece of user interaction (UI:R) - a victim visiting a crafted HTML page. The signals are largely consistent and point to real but not yet realized risk: SSVC reports Exploitation: none (no observed or public exploitation), Automatable: no (user interaction breaks mass/worm-style automation), and Technical Impact: total (full control of the targeted process). Consistent with SSVC Exploitation: none, this CVE is not indicated as CISA KEV in the input, and no EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the data. No PoC or exploit reference appears among the references, so this is 'no public exploit identified at time of analysis.' The vuln.today Decision label is 'this_week,' which aligns with a Chromium High-severity use-after-free: serious and worth prompt patching, but not flagged act_now/emergency. One important scoping nuance the raw 8.8 obscures: the description states code execution occurs 'inside the sandbox,' i.e. within Chrome's renderer sandbox, not a full host compromise - the S:U (scope unchanged) metric reflects this, and absent a chained sandbox-escape the practical impact is bounded by the sandbox.

An attacker hosts a malicious web page (or injects malicious content into a page the victim already trusts via a compromised ad or iframe) that drives Chrome's WebAudio implementation into a use-after-free condition. When the victim navigates to the page, the freed-then-reused memory is manipulated to achieve arbitrary code execution within the renderer sandbox. No public exploit code was identified in the provided sources, so this scenario is inferred from the CVSS vector (network, low complexity, requires user interaction) and the CWE-416 classification.