Google Chrome CVE-2026-121137

Exploitation requires the victim to open a crafted HTML page in a vulnerable Chrome build (prior to 157.0.8103.38) and interact with it so the DevTools type-confusion code path is reached - this is the social-engineering/user-interaction prerequisite (UI:R) that gates the attack. No authentication or elevated privileges are needed (PR:N), and the page is delivered over the network (AV:N) against default configurations. The principal limiting factors are: mandatory user interaction (not automatable, defeating drive-by mass exploitation per SSVC Automatable=no) and the fact that resulting code execution is confined inside the browser sandbox, requiring a further sandbox-escape to compromise the host. The precise mechanism that triggers the type confusion is not described in the available sources.

Signals are mostly consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction (UI:R) - the victim must be lured to a crafted HTML page, consistent with the description's 'social engineering' requirement. CWE-843 type confusion in DevTools matches the 'Memory Corruption'/'RCE' tags. Critically, the described code execution is confined 'inside the sandbox' (S:U, no scope change), so a separate sandbox-escape chain would be needed for full host compromise - this materially lowers real-world impact versus a renderer-to-kernel full RCE. The SSVC framework reinforces a moderate priority: Exploitation=none (no observed exploitation), Automatable=no (user interaction defeats mass automation), Technical Impact=total. This is consistent with the vuln.today 'this_week' decision label rather than an immediate act-now. No EPSS score and no KEV listing are provided, and no verified public exploit is present, so there is no evidence of active or imminent widespread exploitation. The dominant risk driver is Chrome's ubiquity, not exploitation likelihood: patch within the vendor's normal cadence (this week) rather than treating it as an active-exploitation emergency.

An attacker crafts a malicious HTML page and uses social engineering (phishing link, malvertising) to convince a Chrome user to open it and interact with DevTools-related content, triggering a type confusion that executes attacker-controlled code within the renderer/DevTools sandbox. No public exploit is identified at time of analysis, and the attack requires victim interaction (UI:R), so it is not suitable for unattended mass exploitation. Code execution is limited to inside the sandbox, so additional vulnerabilities would be required to reach the underlying host.