Google Chrome CVE-2026-121230

Exploitation requires a victim to visit attacker-controlled web content (UI:R) in a vulnerable Chrome build prior to 157.0.8103.38; the triggering path is the ANGLE graphics component (per the description), consistent with crafted HTML/WebGL rendering. The key limiting factor is the race condition (CWE-362) reflected as AC:H: the attacker must reliably win a timing window, so success is probabilistic rather than guaranteed, and the exact trigger steps are not described in the available sources. Because the flaw yields code execution 'outside the sandbox' (S:C), successful exploitation defeats Chrome's renderer sandbox. No special non-default configuration is indicated as required, but mandatory user interaction and high complexity meaningfully constrain real-world exploitation.

Signals conflict and should be weighed carefully. The input CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) describes a network-reachable, unauthenticated flaw with full confidentiality/integrity/availability impact and a scope change - consistent with a renderer sandbox escape to arbitrary code execution. However, AC:H and UI:R materially lower real-world exploitability: the CWE-362 race condition must be won reliably, and a user must be lured into visiting attacker-controlled content, so exploitation is neither one-click-guaranteed nor fully automatable. Notably, Google's own Chromium security severity is rated 'Low', which conflicts with the external CVSS 8.3 'High' score - this gap suggests the practical, reliably-exploitable impact may be lower than the numeric score implies. No EPSS probability was provided, the CVE is not indicated as CISA KEV, and no confirmed working exploit code is listed, so there is no signal of active or widespread exploitation. The vuln.today decision label is 'this_week' rather than act_now/emergency. Net: a genuinely high-severity memory-safety class issue in ubiquitous software that warrants prompt patching on the vendor's normal stable-channel cadence, but current evidence points to a patch-this-week priority rather than an in-the-wild emergency.

A remote attacker hosts a crafted HTML page (likely exercising WebGL/graphics paths handled by ANGLE) and lures a victim into visiting it. The page repeatedly triggers the race condition in ANGLE; if the attacker wins the race, memory corruption is leveraged to execute arbitrary code outside the Chrome sandbox. High attack complexity (AC:H) means the race is not reliably won, and required user interaction (UI:R) means the victim must actually load the page; no public working exploit is identified in the provided data.