---
id: "CVE-2026-121217"
kind: "vulnerability"
aliases: ["CVE-2026-121217"]
title: "Chrome: streaming use-after-free lets nearby attacker run code in sandbox"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["browser", "chrome", "desktop", "runtime"]
not_affected_if: ["chrome-158-or-later"]
published_at: "2026-11-03T21:17:31+00:00"
first_seen_at: "2026-11-03T21:19:27+00:00"
updated_at: "2026-11-03T21:22:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121217", "first_seen_at": "2026-11-03T21:19:27+00:00"}]
---

# Chrome: streaming use-after-free lets nearby attacker run code in sandbox

A use-after-free bug in Chrome's Streaming component lets an attacker on the same network run code inside the browser sandbox via crafted network traffic. Chromium rates the severity Low.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Chrome version in chrome://settings/help and compare it with `157.0.8103.38`.
- Confirm whether the Chrome build in use is older than `157.0.8103.38`.

## Fix

- Google Chrome: `157.0.8103.38` or later.

## Timeline

- 2026-11-03T21:19:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121217

## From the sources

Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_