Live › vulnerability › CVE-2026-121094
A type confusion bug in V8, the JavaScript engine in Google Chrome, lets a remote attacker run arbitrary code inside the browser sandbox through a crafted HTML page. Chromium rates it High severity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any device running Google Chrome before 157.0.8103.38 is exposed when it opens a malicious web page. Exploitation needs a visit to a crafted page, with no account required. Users on other browsers built on Chromium may need their own vendor's patch.
No product ranges from the sources yet.
chrome://settings/help or chrome://version157.0.8103.38157.0.8103.38157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-121094")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.