Google Chrome CVE-2026-121183

Exploitation requires that the attacker has ALREADY compromised the renderer process - this is a sandbox-escape primitive in the Extensions component, not a standalone remote compromise. The victim must then load attacker-controlled content: a crafted HTML page (UI:R / user interaction required). The flaw is an incorrect-authorization issue (CWE-863) in Chrome's Extensions implementation, affecting Chrome versions prior to 157.0.8103.38. Limiting factors: the dependency on a separate renderer-compromise bug, the need for user interaction to load the crafted page, and high attack complexity (AC:H) meaningfully constrain real-world exploitation despite the network attack vector. The only complete fix stated by the evidence is updating to Chrome 157.0.8103.38 or later.

Signals are moderately consistent but point to a conditional rather than mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) encodes a network-reachable, scope-changing flaw with full CIA impact - the scope change (S:C) reflects a sandbox escape from the renderer to the host, which is why severity is high despite Chromium rating the bug itself 'Medium'. However, two signals temper raw urgency. First, the description states the attacker must have ALREADY compromised the renderer process; this is a chained sandbox-escape primitive, not a standalone drive-by, which is consistent with AC:H and the Chromium 'Medium' rating. Second, SSVC reports Exploitation: none and Automatable: no (Technical Impact: total), and no EPSS score, KEV listing, or confirmed PoC is present in the input - so there is no evidence of active or automatable exploitation. The vuln.today decision label is 'this_week', indicating a prompt-but-not-emergency priority. Net: this is a genuine priority because Chrome is ubiquitous and a patch exists, but it is a second-stage exploitation component requiring a prior renderer compromise plus user interaction, not a wormable unauthenticated RCE. Note one tension worth verifying: CVSS marks PR:N (unauthenticated), yet the real-world precondition of a compromised renderer means practical exploitation depends on possessing a separate renderer bug - treat PR:N as a technical artifact of the sandbox-escape model, not as 'trivially remote'. EPSS is absent, so probabilistic exploitation likelihood could not be weighed.

An attacker who already controls a compromised Chrome renderer process (via a separate prior bug) lures a user to a crafted HTML page that abuses the incorrect-authorization flaw in the Extensions implementation to break out of the renderer sandbox. Success yields arbitrary code execution on the host outside the sandbox. No public exploit code is identified in the provided data, and SSVC reports no observed exploitation.