Google Chrome CVE-2026-121140

Exploitation requires that the attacker has ALREADY compromised Chrome's renderer process (a separate initial exploit), and then requires the victim to load/interact with a crafted HTML page (UI:R) that drives the Internals component into an out-of-bounds read, enabling escape from the renderer sandbox. Limiting factors: this is not a standalone remote bug - it must be chained with a prior renderer compromise; it needs user interaction and is rated high attack complexity (AC:H); and SSVC marks it non-automatable with no observed exploitation. These conditions substantially reduce realistic opportunistic risk despite the high CVSS impact scores. Affected builds are Chrome prior to 157.0.8103.38; updating to 157.0.8103.38 or later is the vendor-provided fix.

This is a genuinely serious but conditional flaw rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) reflects a scope-changing sandbox escape with full CIA impact, which is why Chromium rates it High severity. However, the description states exploitation requires an attacker who 'had compromised the renderer process' - meaning this is a second-stage bug that cannot be triggered standalone and must be chained with a separate initial renderer compromise. The CVSS PR:N (no privileges) does not capture that prerequisite, so the vector understates the real-world barrier: note the discrepancy - PR:N conflicts with the description's explicit precondition of a pre-compromised renderer. The decision signals corroborate a measured posture: SSVC reports Exploitation=none, Automatable=no, Technical Impact=total, and the input carries no KEV listing and no EPSS score, so there is no evidence of active exploitation or mass automatability. The vuln.today priority is 'this_week', consistent with a patch-promptly (not patch-immediately) stance. No EPSS value is provided, so quantitative exploitation probability cannot be stated. Net: a high-impact sandbox escape that materially raises the value of any renderer bug it is paired with, but current intelligence shows no public exploit and no observed exploitation.

An attacker who has already achieved code execution inside Chrome's sandboxed renderer (via a separate, chained vulnerability) lures or keeps a victim on a crafted HTML page that drives the Internals component into an out-of-bounds read. By leveraging the leaked/controlled memory, the attacker breaks out of the renderer sandbox and runs arbitrary code in the higher-privileged browser context on the host. No public exploit identified at time of analysis; the attack requires both user interaction (UI:R) and high complexity (AC:H).