Google Chrome CVE-2026-121234

Exploitation requires the victim to open a crafted HTML page in Google Chrome on Android at a version prior to 157.0.8103.38; the flaw is in the Contacts component and allows privilege elevation leading to code execution outside the browser sandbox. The vector is remote and unauthenticated (PR:N), but it is gated on user interaction (UI:R) - the target must be induced to load attacker-controlled content, so there is no fully automatic/drive-by guarantee without that interaction. Limiting factors: the vulnerability is specific to the Android build of Chrome, is fixed in 157.0.8103.38, is not reported as under active exploitation (SSVC Exploitation: none), and SSVC marks it not automatable. The precise trigger mechanism within Contacts is not described in the available sources.

The signals conflict sharply and that tension is the headline. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields 9.6 Critical, driven by a scope change (sandbox escape) with full confidentiality, integrity and availability impact. However, Chromium's own security severity rating is only Medium, and the SSVC decision framework reports Exploitation: none and Automatable: no (Technical Impact: total). These are not contradictory if read correctly: the CVSS 9.6 reflects worst-case technical impact, while Chromium's Medium rating and SSVC 'Automatable: no' reflect that real-world exploitation requires user interaction (UI:R - the victim must open attacker content) and is not currently observed or mass-automatable. EPSS is not provided, and there is no CISA KEV listing (consistent with SSVC Exploitation: none), so there is no evidence of active exploitation. The vuln.today decision label is act_now, which here means a patch is available and should be applied promptly rather than implying observed in-the-wild attacks. Net: a genuinely high-impact sandbox-escape class issue that warrants prompt patching because a fix exists, but the absence of exploitation evidence and the user-interaction requirement place it below an actively-exploited emergency. EPSS is missing - exploitation probability cannot be quantified from the supplied data.

A remote attacker hosts a crafted HTML page and lures a Chrome-on-Android user into visiting it; the page abuses the Contacts privilege-elevation flaw to escape the browser sandbox and run code with elevated privileges on the device. No public exploit or PoC is identified in the supplied data, and the chromium issue reference is a restricted bug tracker entry, not working exploit code. The attack is gated on user interaction (the victim must open the page).