{"id":"CVE-2026-121182","kind":"vulnerability","aliases":["CVE-2026-121182"],"related":[],"title":"Chrome: use-after-free in DOM lets a web page run code","description":"Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"A use-after-free bug in the DOM code of Google Chrome before 157.0.8103.38 lets a remote attacker run code inside the browser sandbox via a crafted HTML page. Chromium rates it High severity.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","chrome","linux","macos","package","windows"],"not_affected_if":["chrome-updated","non-chrome-browser"],"how_to_check":"- Open Chrome's About page (`chrome://settings/help`) and compare the version with `157.0.8103.38`.\n- Check the installed version on managed machines through your device management tool.","fix":"- Google Chrome: move to `157.0.8103.38` or later.","status":"open","published_at":"2026-11-03T21:17:26+00:00","first_seen_at":"2026-11-03T21:19:24+00:00","triaged_at":"2026-11-03T21:23:07+00:00","updated_at":"2026-11-03T21:23:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T21:23:07Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.38` or later.","reach":"internet","title":"Chrome: use-after-free in DOM lets a web page run code","impact":"high","summary":"A use-after-free bug in the DOM code of Google Chrome before 157.0.8103.38 lets a remote attacker run code inside the browser sandbox via a crafted HTML page. Chromium rates it High severity.","audience":"everyone","category":"package","nicknames":[],"who_cares":["chrome","browsers","windows","macos","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs code inside the browser sandbox from a crafted page","analyst_note":"","how_to_check":"- Open Chrome's About page (`chrome://settings/help`) and compare the version with `157.0.8103.38`.\n- Check the installed version on managed machines through your device management tool.","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: open Chrome's menu, go to Help > About Google Chrome, and let it update.","needs_analyst":false,"not_affected_if":["chrome-updated","non-chrome-browser"],"who_is_affected":"Anyone running Google Chrome before 157.0.8103.38 who opens untrusted web pages is exposed. Chromium-based browsers that pull the same DOM code may also be affected, but the sources only name Google Chrome. Teams that only use managed, pinned browser builds should check their fleet version.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4101,"output_tokens":557,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121182':16A,19A '-2026':15A,18A '157.0.8103.38':40B,71C 'allow':72C 'arbitrari':78C 'attack':44B,75C 'browser':20B,49B 'bug':31B 'chrome':1A,21B,38B,68C 'chromium':56B,88C 'code':13A,35B,46B,79C 'craft':53B,85C 'cve':14A,17A 'dom':7A,34B,65C 'execut':77C 'free':5A,30B,63C 'googl':37B,67C 'high':59B,91C 'html':54B,86C 'insid':47B,80C 'let':8A,41B 'linux':22B 'maco':23B 'packag':24B 'page':11A,55B,87C 'prior':69C 'rate':57B 'remot':43B,74C 'run':12A,45B 'sandbox':50B,82C 'secur':89C 'sever':60B,90C 'use':3A,28B,61C 'use-after-fre':2A,27B 'via':51B,83C 'web':10A 'window':25B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome before 157.0.8103.38 who opens untrusted web pages is exposed. Chromium-based browsers that pull the same DOM code may also be affected, but the sources only name Google Chrome. Teams that only use managed, pinned browser builds should check their fleet version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: open Chrome's menu, go to Help > About Google Chrome, and let it update.","pkeys":[],"ptokens":[],"labels":["browsers","chrome","high","linux","macos","package","windows"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121182","severity":null,"published_at":"2026-11-03T21:17:26+00:00","modified_at":"2026-11-03T21:17:26+00:00","first_seen_at":"2026-11-03T21:19:24+00:00","fetched_at":"2026-11-03T21:19:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}