Google Chrome CVE-2026-121249

Exploitation requires a victim running Google Chrome prior to 157.0.8103.38 to open an attacker-controlled crafted HTML page (UI:R in the vector); the vulnerable component is ANGLE, Chrome's default graphics abstraction layer, so no non-default configuration is needed. No authentication is required (PR:N). The primary limiting factor is the mandatory user interaction - the victim must navigate to or render the malicious page - which constrains this to drive-by / social-engineering delivery rather than fully autonomous remote exploitation (consistent with SSVC Automatable: no). The specific trigger within ANGLE that causes the overflow is not described in the available sources.

This is a genuine high-priority issue, not an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page, with a scope change (S:C) that matches the description's explicit claim of code execution OUTSIDE the renderer sandbox - a sandbox escape, which is the most severe class of browser bug. SSVC reinforces the impact side (Technical Impact: total) while tempering the urgency side (Exploitation: none, Automatable: no), indicating no observed exploitation and that mass, hands-off exploitation is not currently expected; despite that, the vuln.today Decision label is act_now, driven by the total technical impact plus an available vendor patch. These signals are consistent rather than conflicting: a total-impact sandbox escape warrants prompt patching even without active exploitation. EPSS is NOT provided in the input, so probability-of-exploitation cannot be quantified here. The CVE is NOT in CISA KEV and no public exploit or PoC reference is present, so there is no evidence of active exploitation - the priority rests on impact and patch availability, not on confirmed in-the-wild use.

An attacker hosts or compromises a web page containing malicious content that drives Chrome's ANGLE graphics layer and lures a victim into visiting it (UI:R). When the page is rendered, a stack buffer overflow in ANGLE is triggered, and because the flaw permits escaping the renderer sandbox, the attacker achieves arbitrary code execution on the victim's host. No public exploit identified at time of analysis; the low attack complexity (AC:L) means that once a working trigger is developed, exploitation is reliable but still gated on the user visiting the page.