Google Chrome CVE-2026-121181

Exploitation requires a victim to open a crafted HTML page in a vulnerable Google Chrome build prior to 157.0.8103.38 (UI:R) - there is no authentication requirement (PR:N), but the mandatory user interaction (visiting/loading attacker-controlled content) is the primary limiting factor. A successful trigger yields arbitrary code execution confined to the renderer sandbox per the vendor description, so impact on the host is bounded unless combined with a separate sandbox-escape vulnerability. The precise trigger mechanism within the Editing component is not described in the available sources beyond its classification as a use-after-free (CWE-416). The complete fix is updating to 157.0.8103.38; no alternative mitigation is stated by the vendor.

Signals are mixed but point to a genuine 'patch promptly' issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw whose only barrier is user interaction - a victim must load a crafted HTML page. The SSVC framework qualifies this considerably: Exploitation=none (no observed exploitation), Automatable=no, Technical Impact=total; combined with the vuln.today Decision label of 'this_week' (not act_now/emergency), this is an important-but-not-critical priority. KEV status is not listed (not in CISA KEV), and no EPSS score was supplied, so exploitation probability cannot be quantified from the input. Crucially, the description states code execution occurs 'inside the sandbox,' meaning a successful trigger yields renderer-level compromise and would still require a separate sandbox-escape to fully own the host - the CVSS C/I/A:H reflects total impact within the renderer scope (S:U). No public exploit or working PoC is indicated in the input (the chromium issue tracker link is a restricted bug reference, not exploit code). Net: a real, broadly-relevant browser memory-corruption bug worth fast patching, but current signals (SSVC exploitation=none, no KEV, no PoC) suggest it is not under active mass exploitation at time of analysis.

An attacker hosts or compromises a web page containing HTML crafted to trigger the use-after-free in Chrome's Editing component, then lures a victim into visiting it (UI:R). When the page loads, the freed object is reused to achieve arbitrary code execution within the renderer sandbox. No public exploit or verified PoC is identified in the available data; full host compromise would additionally require chaining a sandbox escape.