Google Chrome CVE-2026-121214

Exploitation requires a victim using Google Chrome prior to 157.0.8103.38 to load attacker-controlled content - specifically a crafted HTML page (UI:R in the CVSS vector), such as by visiting a malicious site. No authentication or prior privileges are needed (PR:N), and default configurations are affected since the Passwords component is a standard built-in feature. The primary limiting factor is the required user interaction (the victim must open/visit the malicious page) and the need for the use-after-free to be leveraged into a reliable sandbox escape; AC:L indicates no additional specialized conditions are described in the available sources.

This is a genuine high priority, not a high-CVSS-but-low-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction, and the scope change (S:C) reflects the key danger: a use-after-free (CWE-416) in Chrome's Passwords component that can lead to code execution OUTSIDE the renderer sandbox. The vuln.today decision label is act_now and the vendor has shipped a fix, which together argue for prompt patching. The signals are, however, not unanimous: the SSVC framework reports Exploitation: none and Automatable: no (consistent with no CISA KEV listing and no public PoC in the references), while rating Technical Impact: total - so the severity is confirmed but active exploitation is NOT. No EPSS score was supplied, so statistical exploitation probability cannot be weighed. In short, maximum technical impact and ubiquitous exposure justify urgency, but current evidence points to no in-the-wild exploitation yet; treat this as 'patch now on the merits of impact and reach,' not 'respond to an ongoing campaign.'

An attacker hosts a crafted HTML page and lures a victim running a vulnerable Chrome build (before 157.0.8103.38) to visit it, for example via a phishing link or a malicious ad. The page triggers the use-after-free in the Passwords component, and because the flaw can lead to code execution outside the sandbox (S:C), successful exploitation could run arbitrary code on the host. No public exploit code was identified in the provided references, so this reflects the mechanism implied by the CVSS vector rather than a demonstrated exploit.