Live › vulnerability › CVE-2026-121077
A use-after-free bug in the mobile version of Google Chrome can be triggered by a crafted HTML page. A remote attacker who tricks a user into visiting that page could potentially run arbitrary code outside the browser sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone using Chrome on a mobile device before version 157.0.8103.38 who visits a malicious or compromised web page. Exploitation needs the user to open the attacker's page, which is the social engineering element in the description. Desktop Chrome and other browsers are not covered by this entry.
No product ranges from the sources yet.
157.0.8103.38; anything older is in the affected range.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121077")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.