Google Chrome CVE-2026-121246

Exploitation requires a victim running Google Chrome on Android at a version prior to 157.0.8103.38 to actively open or navigate to an attacker-crafted HTML page that exercises the vulnerable WebGL code path (UI:R - user interaction is mandatory). No authentication or prior privileges are needed (PR:N). Limiting factors: the flaw is Android-specific per the description, affects only versions below the patched 157.0.8103.38 build, and cannot be triggered without the user loading attacker content, so purely background or non-interactive exploitation is not indicated; SSVC also assesses it as not automatable, reducing the likelihood of wormable mass exploitation.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) indicates a network-reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction, and the scope change (S:C) is consistent with the description's claim of code execution OUTSIDE the renderer sandbox - a serious escalation for a browser bug. Signals partly conflict on urgency: the vuln.today Decision label is act_now and the vendor rates it Critical, yet SSVC reports Exploitation: none and Automatable: no, meaning CISA's framework sees no observed exploitation and no reliable mass-automation path (consistent with UI:R requiring a victim to browse to a page). No EPSS score was provided and the CVE is not in CISA KEV, so there is no probabilistic or confirmed-exploitation signal to weigh; the act_now label therefore rests on severity and the sandbox escape rather than on evidence of active attacks. SSVC Technical Impact: total aligns with the C:H/I:H/A:H full-impact rating. Net: treat as urgent patching per the act_now Decision label, while recognizing exploitation is not currently observed and is not automatable.

A remote attacker hosts a crafted HTML page exercising a WebGL use-after-free and lures an Android user to open it in Chrome (via link, ad, or compromised site). Because only passive user interaction is needed (UI:R) and no authentication is required, visiting the page can corrupt freed memory and potentially achieve arbitrary code execution outside the browser sandbox. No public exploit code was identified at time of analysis, so this remains a plausible but not demonstrated-public attack.