Live › vulnerability › CVE-2026-121185
Google Chrome versions before 157.0.8103.38 have a use-after-free bug in the Picture-in-Picture feature. A remote attacker who tricks a user into opening a crafted HTML page can execute arbitrary code outside the browser sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Any device running Google Chrome older than 157.0.8103.38 is exposed when a user visits a malicious page. Browsers on managed fleets should be checked centrally. Users who do not run that Chrome build can skip it.
No product ranges from the sources yet.
chrome --version on the machine157.0.8103.38157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-121185")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.