Live › vulnerability › CVE-2026-121178
A use-after-free bug in Aura, Chrome's windowing layer, can be triggered from a crafted HTML page by an attacker who already controls the renderer process. Successful exploitation could run arbitrary code outside the browser sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome older than 157.0.8103.38 on desktop platforms that use Aura is potentially exposed. The attack needs a renderer compromise first, so it is a chained exploit that starts with a malicious web page. Managed fleets should confirm the Chrome build across all machines.
No product ranges from the sources yet.
chrome://settings/help or google-chrome --version157.0.8103.38157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-121178")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.