{"id":"CVE-2026-121079","kind":"vulnerability","aliases":["CVE-2026-121079"],"related":[],"title":"Chrome: V8 race condition lets a crafted web page run code","description":"Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"A race condition in V8, the JavaScript engine in Google Chrome before 157.0.8103.38, lets a remote attacker run arbitrary code inside the browser sandbox by getting a victim to load a crafted HTML page. Chromium rates it High severity.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","desktops","runtime","v8"],"not_affected_if":["chrome-at-or-above-157.0.8103.38"],"how_to_check":"- Open Chrome and check the version under Settings > About Chrome, or run `chrome://version` in the address bar.\n- Compare the installed version against `157.0.8103.38`.","fix":"- Google Chrome: move to `157.0.8103.38` or later.","status":"open","published_at":"2026-11-03T21:17:13+00:00","first_seen_at":"2026-11-03T21:19:12+00:00","triaged_at":"2026-11-03T21:26:49+00:00","updated_at":"2026-11-03T21:26:49+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-03T21:26:49Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.38` or later.","reach":"internet","title":"Chrome: V8 race condition lets a crafted web page run code","impact":"high","summary":"A race condition in V8, the JavaScript engine in Google Chrome before 157.0.8103.38, lets a remote attacker run arbitrary code inside the browser sandbox by getting a victim to load a crafted HTML page. Chromium rates it High severity.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","browser","desktops","v8"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs code inside the browser sandbox after a victim visits a page","analyst_note":"Confirm whether other Chromium-based browsers ship the same V8 fix and the exact patched version from the Chrome release notes.","how_to_check":"- Open Chrome and check the version under Settings > About Chrome, or run `chrome://version` in the address bar.\n- Compare the installed version against `157.0.8103.38`.","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: Settings > About Chrome.","needs_analyst":true,"not_affected_if":["chrome-at-or-above-157.0.8103.38"],"who_is_affected":"Anyone who runs Google Chrome before 157.0.8103.38 and visits a web page that could be crafted by an attacker. Chromium-based browsers that bundle the same V8 engine may also be affected, but the sources only name Google Chrome. Teams that manage desktops should check the browser build across their fleet.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":4101,"output_tokens":603,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121079':14A,17A '-2026':13A,16A '157.0.8103.38':35B,71C 'allow':72C 'arbitrari':41B,78C 'attack':39B,75C 'browser':18B,45B 'chrome':1A,19B,33B,68C 'chromium':57B,88C 'code':11A,42B,79C 'condit':4A,25B,63C 'craft':7A,54B,85C 'cve':12A,15A 'desktop':20B 'engin':30B 'execut':77C 'get':48B 'googl':32B,67C 'high':60B,91C 'html':55B,86C 'insid':43B,80C 'javascript':29B 'let':5A,36B 'load':52B 'page':9A,56B,87C 'prior':69C 'race':3A,24B,62C 'rate':58B 'remot':38B,74C 'run':10A,40B 'runtim':21B 'sandbox':46B,82C 'secur':89C 'sever':61B,90C 'v8':2A,22B,27B,65C 'via':83C 'victim':50B 'web':8A","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs Google Chrome before 157.0.8103.38 and visits a web page that could be crafted by an attacker. Chromium-based browsers that bundle the same V8 engine may also be affected, but the sources only name Google Chrome. Teams that manage desktops should check the browser build across their fleet.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: Settings > About Chrome.","pkeys":[],"ptokens":[],"labels":["browser","chrome","desktops","high","runtime","v8"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121079","severity":null,"published_at":"2026-11-03T21:17:13+00:00","modified_at":"2026-11-03T21:17:13+00:00","first_seen_at":"2026-11-03T21:19:12+00:00","fetched_at":"2026-11-03T21:19:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}