Google Chrome CVE-2026-121129

Exploitation requires the victim to load attacker-controlled content in Chrome - the description specifies a crafted HTML page, and the CVSS vector's UI:R confirms user interaction (visiting the page) is mandatory; it is not drive-by with zero interaction in the strict AV:N/UI:N sense. No authentication or prior privileges are needed (PR:N). The key LIMITING factor is scope: the description states code executes INSIDE the Chrome sandbox (S:U), so a full system compromise additionally requires a separate sandbox-escape not covered by this CVE. Affected builds are Chrome prior to 157.0.8103.38; updating to that version or later removes the flaw. The precise trigger within WebRTC is not described in the available sources beyond the use-after-free classification.

This is a genuine high-priority patch item for any environment running Google Chrome, but the signals are moderately strong rather than emergency-grade. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction - the victim must open a crafted web page. Chromium rated the security severity High, and CWE-416 (use-after-free) in a renderer component is a well-established path to memory corruption and code execution. The vuln.today decision label is 'this_week', consistent with a serious-but-not-actively-exploited browser bug. Important limiting nuance stated in the description itself: arbitrary code execution occurs INSIDE the Chrome sandbox (scope unchanged, S:U), so a successful exploit does not by itself yield host compromise - it would need to be chained with a separate sandbox-escape to reach the operating system. No EPSS score was provided, so exploitation probability cannot be quantified. KEV status is not indicated (treat as not listed), and no proof-of-concept or exploit reference is present in the input - the two cited chromium.org/chromereleases links are the vendor advisory and the issue tracker, not working exploit code. Net: real priority for prompt patching, but no evidence of active exploitation or public exploit at this time.

A remote attacker hosts or compromises a web page containing crafted content that drives Chrome's WebRTC component into a use-after-free state when the victim visits it. The dangling-pointer condition is leveraged to corrupt memory and execute attacker-controlled code within the renderer's sandboxed process. Because execution is confined to the sandbox, the attacker would typically pair this with a separate sandbox-escape to affect the underlying system; no public exploit code is identified at time of analysis.