Live › vulnerability › CVE-2026-121119
A use-after-free bug in the Controls component of Google Chrome before 157.0.8103.38 lets a remote attacker run arbitrary code inside the browser sandbox through a crafted HTML page. Chromium rates the issue High severity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any desktop install of Google Chrome before 157.0.8103.38 is exposed, since the attack needs only that the user loads a crafted HTML page. Managed fleets should confirm that their Chrome builds are updated. Chromium-based browsers may carry the same flaw until they ship their own fix; the sources do not say which ones do.
No product ranges from the sources yet.
google-chrome --version on Linux.157.0.8103.38; anything older is in the affected range.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-121119")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.