Live › vulnerability › CVE-2026-121070
A use-after-free bug in the WTF library of Google Chrome lets a remote attacker run code inside the browser sandbox when a victim opens a crafted HTML page. The sources say the attack needs only a crafted page, and the chromium severity rating is Medium.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome before 157.0.8103.38 is exposed when they open a crafted HTML page. Chromium-based browsers that pull in the same WTF code may also be affected, and those should be checked against their own release notes. Managed fleets with auto-update disabled are the most likely to remain exposed.
No product ranges from the sources yet.
google-chrome --version.157.0.8103.38.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121070")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.