Live › vulnerability › CVE-2026-121211
A use-after-free bug in the PowerBookmarks feature of Google Chrome can be chained by an attacker who already controls the renderer process and uses social engineering to get a crafted Chrome extension installed. The result is arbitrary code execution outside the browser sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Desktop Chrome users running a version earlier than 157.0.8103.38. The attack first needs a compromised renderer and a user who installs a malicious extension, so exposure depends on extension installs. Organizations that manage Chrome fleets should confirm the managed version.
No product ranges from the sources yet.
chrome://version or the About pagechrome://extensions for anything unexpected157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-121211")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.