Google Chrome CVE-2026-121256

Exploitation is NOT possible from a clean default state: the description requires that the attacker has already compromised the renderer process, so this is a chained second-stage sandbox escape, not standalone remote code execution. Given that foothold, the attacker must get the victim to load a crafted HTML page (UI:R - user interaction required) and successfully trigger the use of a released GPU resource, which carries high attack complexity (AC:H) because the released-resource reuse must be won/controlled reliably. Limiting factors for defenders: a prior renderer compromise is a hard prerequisite, user navigation to attacker content is needed, and all affected installs are Chrome versions below 157.0.8103.38 - patched builds are not exploitable. SSVC marks the issue Automatable: no, so there is no indication of a reliable mass-automation path. The input does not describe the precise trigger mechanism of the released-resource reuse beyond the CWE-672 classification.

Signals are mixed and should be read together. The CVSS 3.1 base score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C with C:H/I:H/A:H) is driven largely by the scope change (sandbox escape) and total impact, but AC:H and UI:R already encode real friction. The SSVC framework reports Exploitation: none, Automatable: no, Technical Impact: total - i.e. no observed or proven exploitation and no mass-automation path, but full compromise if achieved. This aligns with the vuln.today 'this_week' priority rather than an emergency label. Notably, Chromium's own internal rating is 'Medium', which is lower than the 8.3 would suggest; this gap exists because the flaw is not independently exploitable - the description explicitly requires an attacker who has ALREADY compromised the renderer process, so CVE-2026-121256 is a second-stage sandbox-escape primitive rather than a standalone remote code execution bug. No EPSS score is provided in the input, so probabilistic exploitation likelihood cannot be quoted. There is no CISA KEV listing and no public exploit in the input (the chromium issue tracker link is a bug reference, not working exploit code), so exploitation status is 'no public exploit identified at time of analysis'. Net: a genuine fix-this-week item for a ubiquitous product, but its real-world danger is as the escape link in a chain, not as a single-click RCE; the high base score should not be mistaken for drive-by, automatable mass exploitation.

An attacker who has already compromised a Chrome renderer process (via a separate bug) delivers a crafted HTML page that causes the GPU process to operate on a GPU resource after it has been released, corrupting state in the more-privileged GPU process. By controlling that freed-resource reuse, the attacker executes code outside the renderer sandbox, achieving a full sandbox escape. No public exploit is identified in the available data, and successful triggering depends on the victim loading attacker-controlled content (UI:R) and on high attack complexity (AC:H).