Google Chrome CVE-2026-121148

Exploitation requires a victim using a vulnerable Chrome build (prior to 157.0.8103.38) to load attacker-controlled web content - the crafted HTML page that triggers the use-after-free in the ANGLE graphics component; this user interaction (UI:R: visiting/rendering the page) is the primary limiting factor and no authentication is required (PR:N). No special non-default configuration is indicated by the description - standard Chrome rendering of web/graphics content is the affected surface. The decisive and distinguishing condition is that the flaw results in code execution OUTSIDE the Chrome sandbox (CVSS S:C), so it is not contained by renderer sandboxing; the exact memory-corruption trigger mechanism within ANGLE is not described in the available sources. The only complete fix stated by the evidence is updating to Chrome 157.0.8103.38 or later.

This is a genuine high priority, not an inflated-CVSS artifact. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction (UI:R), and the changed scope (S:C) reflects the key danger called out in the description: code execution OUTSIDE the Chrome sandbox from a renderer-side use-after-free in ANGLE (Chrome's OpenGL ES/WebGL abstraction layer). The signals are partly in tension and this must be stated plainly: the vuln.today Decision label is 'act_now', yet CISA SSVC lists Exploitation=none and Automatable=no, and no EPSS score was supplied - so urgency here is driven by the total technical impact (SSVC Technical Impact=total) and the sandbox-escape class rather than by any evidence of in-the-wild use. There is no CISA KEV listing in the input and no exploit/PoC reference among the sources, so this should be treated as a severe-but-not-yet-known-exploited browser RCE where patching speed matters because of impact and the historically short time-to-exploit for ANGLE/graphics bugs, not because active exploitation is confirmed.

An attacker hosts or compromises a web page containing crafted content that drives Chrome's ANGLE graphics layer into a use-after-free state; a victim running a vulnerable Chrome build (prior to 157.0.8103.38) simply visits the page, satisfying the required user interaction. Because the flaw yields code execution outside the sandbox (S:C), successful exploitation can lead to full compromise of the host rather than mere renderer-process corruption. No public exploit or PoC reference is present in the supplied data, and the low attack complexity (AC:L) means a reliable exploit, if developed, would need no unusual preconditions.