Chrome for Android CVE-2026-121241

Exploitation requires user interaction (CVSS UI:R): the victim must load an attacker-controlled crafted HTML page in Google Chrome on Android on a version prior to 157.0.8103.38. No authentication or prior privileges are needed (PR:N). The decisive characteristic is that successful exploitation breaks out of the Chrome sandbox (S:C), meaning the arbitrary code runs with impact beyond the browser process. Limiting factors that reduce real-world risk: it only affects the Android build of Chrome below the fixed version, it needs the user to actually navigate to or open the malicious page, and the precise mechanism that triggers the use-after-free in Navigation is not described in the available sources.

This is a genuine high-priority issue, not a high-CVSS paper tiger. The CVSS 3.1 base score of 9.6 is driven by a network vector (AV:N), low complexity (AC:L), no privileges (PR:N), and a scope change (S:C) reflecting that the use-after-free in Navigation lets code execute OUTSIDE the Chrome renderer sandbox - a sandbox escape, which is the most dangerous class of browser bug. The only brake on the vector is UI:R: a victim must load attacker-controlled content. Signals partially conflict and must be weighed: the vendor/aggregator Decision label is 'act_now' and SSVC rates Technical Impact as 'total', yet SSVC also records Exploitation as 'none' and Automatable as 'no', and the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation at this time. EPSS is not provided in the input, so exploitation probability cannot be quantified - this is a missing signal, not a low one. Net assessment: a fully-weaponizable sandbox-escaping RCE in an extremely widely deployed product with a patch already shipped; urgency is high (consistent with act_now) because of the total technical impact and Chrome's footprint, even though exploitation has not yet been observed in the wild.

A remote attacker hosts a crafted HTML page and lures a victim running Chrome on Android (prior to 157.0.8103.38) to open it. Loading the page triggers a use-after-free in the Navigation component, which the attacker leverages to execute arbitrary code outside the browser sandbox on the device. No public exploit identified at time of analysis; the linked Chromium issue (574791491) is a restricted bug-tracker entry, not working exploit code.