Google Chrome CVE-2026-121200

Exploitation requires an attacker to socially engineer a victim into opening a crafted HTML page in Google Chrome and into an interaction involving DevTools (the fault is in DevTools' reference resolution per the description); it is not a silent drive-by. The CVSS vector's UI:R confirms required user interaction, and PR:N indicates no prior authentication is needed, so exploitation is unauthenticated but user-interaction-gated. Limiting factors that reduce real-world risk: the dependence on victim interaction with DevTools and successful social engineering, SSVC Automatable:no (cannot be mass-automated), and affected versions being only those prior to 157.0.8103.38 (patched builds are not exploitable). The exact feature state or sequence that triggers the flaw is not detailed in the available sources.

Signals conflict sharply and must be weighed together. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields 9.6 (Critical), driven largely by the scope change (S:C) representing the DevTools sandbox escape and full C/I/A impact - yet Google's own Chromium severity rating is only Medium, a notable divergence that suggests the practical exploitability or reachability is lower than the raw score implies. SSVC reinforces caution: Exploitation is 'none' (no observed exploitation) and Automatable is 'no' (the AC:L but UI:R + social-engineering requirement means an attacker cannot mass-automate it), while Technical Impact is 'total' (consistent with full code execution). No EPSS score was provided, there is no CISA KEV listing, and no verified proof-of-concept is present in the references - so there is no public evidence of active or imminent exploitation. Against all that, the vuln.today Decision label is act_now, which should govern remediation urgency. Net read: this is a patch-promptly item because of total technical impact and an available vendor fix in a ubiquitously-deployed product, but exploitation realistically requires luring a user into opening a crafted page and interacting with DevTools, so it is not a drive-by wormable threat. The CVSS-vs-Chromium-Medium gap and the absence of EPSS/exploitation evidence should temper any treatment of this as an emergency-grade mass-exploitation risk.

An attacker uses social engineering to convince a victim to open a crafted HTML page in Chrome and interact with it under conditions involving DevTools, where incorrect reference resolution (CWE-706) is triggered. The flaw allows code execution outside the browser sandbox, giving the attacker control on the host beyond the renderer. No verified public exploit code was identified in the provided sources, and the precise interaction sequence is not described in the available data.