Google Chrome CVE-2026-121219

Exploitation requires (1) a pre-existing compromise of the Chrome renderer process via a separate vulnerability - the description states the attacker must have 'compromised the renderer process'; (2) user interaction, specifically the victim loading a crafted HTML page (UI:R); and (3) reaching the vulnerable integer-overflow code path in the GPU process. The GPU process and hardware-accelerated rendering must be active. Limiting factors: high attack complexity (AC:H) and the mandatory renderer-compromise precondition mean this cannot be triggered standalone and must be chained; versions at or above 157.0.8103.38 are not affected. These constraints substantially narrow realistic exploitation to capable, targeted actors.

This is a genuinely serious issue but with an important nuance that tempers raw urgency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, score 8.3) reflects a sandbox-escape with total technical impact (SSVC Technical Impact: total; S:C scope change confirms the boundary crossing). However, the description is explicit that exploitation requires 'a remote attacker who had compromised the renderer process' - this is not a standalone drive-by RCE but a second-stage sandbox escape that must be chained with a separate renderer-compromise bug. This precondition is consistent with the CVSS AC:H (high attack complexity) and explains why Chromium rated the security severity only Medium despite the 8.3 numeric score. The SSVC framework reports Exploitation: none and Automatable: no, and there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active exploitation or widespread automated attack. The vuln.today Decision label is 'this_week' (not act_now/emergency), aligning with a patch-promptly-but-not-drop-everything posture. Net assessment: real priority for any Chrome-based fleet because the affected product is ubiquitous and the impact is full code execution outside the sandbox, but it is a chain component rather than a single-shot exploit, and no exploitation has been observed. Note the signal to verify: PR:N implies no privileges, yet the description's 'compromised the renderer process' prerequisite is effectively a precondition the base CVSS encodes as complexity rather than privilege.

An attacker first compromises the Chrome renderer process using a separate vulnerability, then lures a user to a crafted HTML page that triggers the integer overflow in the GPU process to execute code outside the sandbox on the host. No public exploit code or PoC has been identified; the only tracker reference is a restricted Chromium issue. High attack complexity and the requirement for a pre-existing renderer compromise plus user interaction make this a chained, targeted scenario rather than a mass-exploitation one.