Google Chrome CVE-2026-121182

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build (any version prior to 157.0.8103.38), matching the CVSS UI:R requirement - there is no drive-by-without-interaction path described. A key limiting factor is that the resulting arbitrary code execution is contained within the renderer sandbox (S:U, explicitly 'inside the sandbox'), so by itself it does not grant host-level control; a separate sandbox-escape vulnerability would be needed for full system compromise. No special non-default configuration, authentication, or privileges are required beyond getting the user to open attacker-controlled web content.

This is a genuine priority but not an emergency, consistent with the input's 'this_week' decision label. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction - the victim must open a crafted HTML page. The scope is Unchanged (S:U) and the description explicitly states code execution occurs 'inside the sandbox,' so this is NOT a sandbox escape on its own; an attacker would still need to chain a separate sandbox-escape bug to compromise the host, which materially lowers real-world impact versus a full RCE. No EPSS score, no CISA KEV listing, and no verified public exploit are present in the input, so there is no signal of active exploitation - exploitation status is 'no public exploit identified at time of analysis.' Chrome's ubiquity raises aggregate exposure, but the combination of required user interaction, sandbox containment, and an already-available vendor patch argues for prompt patching rather than crisis response. No SSVC 'automatable' or 'technical impact' fields were supplied; the only decision signal provided is the vendor/priority label 'this_week.'

An attacker hosts or injects a malicious HTML page that triggers the use-after-free in Chrome's DOM, then lures a victim running a vulnerable Chrome version (before 157.0.8103.38) to visit it. Successful exploitation yields arbitrary code execution confined to the browser's renderer sandbox; achieving full host compromise would require chaining an additional sandbox-escape vulnerability. No public exploit code is identified in the available data.