Google Chrome CVE-2026-121228

Exploitation requires a victim using Google Chrome prior to 157.0.8103.38 to load attacker-controlled web content - the description specifies 'a crafted HTML page' - so the key prerequisite is user interaction (UI:R): the target must browse to or open the malicious page. No authentication is required (PR:N). The resulting arbitrary code execution is confined to the renderer sandbox ('inside the sandbox'), so without an additional sandbox-escape the attacker does not gain full host control. Limiting factors: mandatory user interaction, the need for the victim to run an unpatched Chrome version, and sandbox containment of the initial code execution.

Signals are consistent and point to a genuine but not emergency priority. CVSS 3.1 is 8.8 (High) with AV:N/AC:L/PR:N, meaning a remote, unauthenticated attacker over the network with low complexity - but UI:R requires the victim to interact (visit/open a crafted HTML page), which materially lowers automatability. This aligns with the SSVC assessment: Exploitation 'none', Automatable 'no' (user interaction defeats fully automated mass exploitation), and Technical Impact 'total'. The vuln.today Decision label is 'this_week', not act_now/emergency. KEV status is not listed (no confirmed active exploitation) and no EPSS score was provided, so exploitation probability cannot be quantified from this input. Crucially, the description states code execution occurs 'inside the sandbox' - i.e., the Chromium renderer sandbox - so by itself this does not yield full host compromise and would need to be chained with a separate sandbox-escape to achieve that; the C:H/I:H/A:H and SSVC 'total' impact describe the renderer process. Net: a real, broadly-relevant browser RCE warranting prompt patching given Chrome's footprint, but tempered by the user-interaction requirement, sandbox containment, and absence of confirmed exploitation or a public exploit.

An attacker hosts or injects a malicious web page containing JavaScript crafted to trigger the V8 type confusion, then lures a victim running a vulnerable Chrome (prior to 157.0.8103.38) to visit it. When the page's script executes in V8, the type confusion lets the attacker run arbitrary code within the renderer sandbox. No public exploit identified at time of analysis; achieving impact beyond the sandbox would require chaining an additional sandbox-escape vulnerability.