Google Chrome CVE-2026-121203

Exploitation requires a victim using Google Chrome prior to 157.0.8103.38 to load attacker-controlled content - a crafted HTML page that exercises the vulnerable Geometry code path (UI:R). No authentication or prior privileges are needed (PR:N), and no non-default configuration is required; any default Chrome install below the fixed version is affected. Key limiting factors: (1) the attack requires user interaction - the victim must navigate to or render the malicious page; (2) resulting code execution is confined to the renderer sandbox (S:U, and the description states 'inside the sandbox'), so a separate sandbox-escape chain would be needed to compromise the host. Updating to 157.0.8103.38 or later is the fix provided by the vendor.

This is a genuine high-priority patching item, though not a drop-everything emergency on current signals. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (visiting a crafted page) and does NOT cross the sandbox boundary (S:U) - the description explicitly confirms code execution is 'inside the sandbox,' so this alone is not a full browser escape. Chromium rates the underlying severity Critical, reflecting the reliability/impact of the use-after-free, while the numeric CVSS is High because of the UI:R requirement and unchanged scope. No EPSS score was provided, so exploitation probability cannot be quantified. No KEV listing and no public exploit are present in the input, so this is 'no public exploit identified at time of analysis' - distinct from active exploitation. The vuln.today decision label is 'this_week,' consistent with a patched, high-severity browser memory-corruption bug that is realistic to weaponize but not yet observed in the wild. SSVC-style read: exploitation=none/public-none, automatable=no (requires a victim to load a page), technical impact=total within the renderer sandbox. Net: treat as a within-the-week priority - patch promptly, but the sandbox confinement and the need for user interaction temper it below an act_now/emergency classification.

An attacker hosts or injects a malicious HTML page that triggers the use-after-free in Chrome's Geometry component when rendered; a victim is lured to visit it (e.g., via link, ad, or compromised site). Successful exploitation yields arbitrary code execution within the renderer sandbox. No public exploit code is identified in the provided data, and the low attack complexity (AC:L) means a reliable trigger is plausible once the bug is understood, but user interaction (UI:R) is required.