Live › vulnerability › CVE-2026-121034
A use-after-free bug in the Views component of Google Chrome on Windows, before version 157.0.8103.38, lets a remote attacker run arbitrary code outside the browser sandbox. The attacker must lure the user into visiting a crafted HTML page via social engineering.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any Windows machine running Google Chrome older than 157.0.8103.38 is exposed when the user opens a crafted HTML page. Exploitation requires social engineering to get the user to a malicious page. Chrome installs on other platforms are not named in this entry.
No product ranges from the sources yet.
chrome --version from a terminal on Windows.157.0.8103.38.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-121034")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.