Google Chrome CVE-2026-121210

Exploitation requires the victim to use an affected Google Chrome desktop build prior to 157.0.8103.38 and to load attacker-controlled web content, as reflected by UI:R in the CVSS vector - the attacker cannot trigger it without the user visiting or rendering a crafted HTML page. No authentication is required (PR:N), and no special non-default configuration is indicated; standard JavaScript/V8 execution, enabled by default, is sufficient. The decisive limiting factor is that arbitrary code execution is confined to the renderer sandbox (S:U / 'inside the sandbox'), so host-level compromise would additionally require a separate sandbox-escape vulnerability not covered by this CVE. The exact V8 state needed to trigger the type confusion is not described in the available sources.

Signals are moderately consistent and point to a real but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw that requires user interaction (loading a crafted page) and yields high confidentiality, integrity and availability impact - but with scope unchanged (S:U), which aligns with the description's key limiter: code executes 'inside the sandbox,' i.e. within the renderer process, not on the host. SSVC tempers the raw score: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (user interaction/targeting required), and Technical Impact is 'total.' The vuln.today decision label is 'this_week,' consistent with a patched, high-severity browser bug that is not under active attack. No EPSS score was provided, and the CVE is not listed in CISA KEV; no PoC or exploit reference appears in the input. Net: a serious memory-safety RCE in a ubiquitous product, worth prompt patching, but current data does not indicate active exploitation, and the sandbox-contained nature means practical host compromise would require chaining with a separate sandbox-escape - a limitation the single CVE does not provide.

A remote attacker hosts or compromises a web page containing JavaScript crafted to trigger the V8 type-confusion flaw, then lures a user of an unpatched Chrome build (prior to 157.0.8103.38) to visit it. When the page's script runs in V8, the type confusion is triggered and the attacker achieves arbitrary code execution within the renderer sandbox. No public exploit or PoC reference is present in the supplied data, and the specific trigger mechanism is not described in the available sources.