Google Chrome CVE-2026-121185

Requires the victim to open attacker-controlled web content in a vulnerable Chrome build (prior to 157.0.8103.38) and to perform the interaction the attacker socially engineers (UI:R in the CVSS vector) - exploitation is not fully automatic drive-by against a passive user per the vector. The specific feature in play is Chrome's Picture-in-Picture functionality, where a use-after-free (CWE-416) is reached via a crafted HTML page; the exact configuration or PiP interaction that triggers the free-then-reuse is not described in the available sources. The notable amplifying condition is that successful exploitation escapes the renderer sandbox (S:C), so impact is not limited to the browser process. Limiting factors: attacker needs user interaction/social engineering and a target still running an unpatched version; no authentication or elevated privileges are required (PR:N).

This is a genuine high-priority issue, not an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) describes network-reachable, low-complexity exploitation requiring no privileges, and the scope change (S:C) is consistent with the description's core claim: code execution OUTSIDE the renderer sandbox, i.e., a sandbox escape rather than a contained renderer bug. The only gating factor is UI:R - the attacker must lure a victim into interacting with a crafted page ('leveraging social engineering'). Signals align and reinforce urgency: Google rates the Chromium severity High, the vuln.today decision label is act_now, and a vendor patch is already available. However, two commonly-weighted signals are MISSING from the input and must not be assumed: there is no EPSS exploitation-probability score provided, and there is no CISA KEV listing in the data, so this is NOT confirmed as actively exploited. No public exploit is identified in the sources either - the issues.chromium.org link is a (likely access-restricted) vendor bug tracker entry, not published exploit code. Net: treat as act_now for patch deployment because of the sandbox-escape impact, ubiquitous footprint, and vendor urgency, while recognizing that real-world exploitation prevalence is unquantified in the absence of EPSS and KEV data.

An attacker crafts a malicious HTML page that abuses the Picture-in-Picture component to trigger a use-after-free, then uses social engineering (e.g., a phishing link or a compromised/ad-injected site) to get a victim to visit it with a vulnerable Chrome build. Successful exploitation yields arbitrary code execution outside the browser sandbox on the victim's machine. No public exploit code is identified in the provided sources, and the specific trigger sequence for the Picture-in-Picture free/reuse is not described in the available data.