Google Chrome CVE-2026-121189

Requires a victim running Google Chrome prior to 157.0.8103.38 to open or navigate to an attacker-crafted HTML page (UI:R - user interaction is mandatory). No authentication is needed (PR:N) and the attack is remote over the network (AV:N) against default configurations. Because the flaw is a use-after-free in the Browser (not renderer) process, successful exploitation escapes the sandbox (S:C) and yields arbitrary code execution on the host. Limiting factors: the victim must actively visit the malicious page, and the specific trigger mechanism is not described in the available sources; Google's own Chromium severity is rated Low, suggesting practical exploitation may be harder than the CVSS implies.

Signals conflict sharply and must be weighed together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects a worst-case outcome: remote, low-complexity, no privileges, with a scope change (S:C) because a use-after-free in Chrome's Browser process escapes the renderer sandbox for full code execution on the host. The only mitigating CVSS factor is UI:R - the victim must open a crafted page. Notably, Google's own Chromium security severity is rated 'Low,' which directly contradicts the 9.6 CVSS; this gap typically reflects Google's internal view of practical exploitability/trigger difficulty versus the theoretical maximum impact the CVSS captures - verify with the vendor advisory. CISA SSVC reports Exploitation: none and Automatable: no (consistent with the user-interaction requirement), but Technical Impact: total (consistent with sandbox-escape RCE). There is no CISA KEV listing, no EPSS score supplied, and no public exploit identified at time of analysis. The vuln.today Decision label is act_now, which is in tension with SSVC's 'Exploitation: none' - the act_now label appears driven by total technical impact plus Chrome's ubiquity rather than by observed exploitation. Bottom line: treat per the act_now label and patch promptly given Chrome's enormous footprint and total impact, while recognizing there is currently no evidence of active exploitation and a vendor severity of Low.

An attacker hosts or compromises a web page containing crafted HTML and lures a victim running Chrome prior to 157.0.8103.38 to visit it. Visiting the page triggers a use-after-free in Chrome's Browser process, letting the attacker execute arbitrary code outside the sandbox on the victim's host. No public exploit identified at time of analysis, and exploitation requires the victim to navigate to the malicious page (UI:R).