Live › vulnerability › CVE-2026-121219
An integer overflow in Chrome's GPU component lets an attacker who has already compromised the renderer process potentially run code outside the browser sandbox. The attacker delivers the trigger through a crafted HTML page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome before 157.0.8103.38 is exposed, since the flaw is in the browser's GPU code. The attack also requires a separate renderer compromise, so it is a chained exploit rather than a single-step attack. Managed fleets should confirm the version on every desktop browser.
No product ranges from the sources yet.
google-chrome --version on Linux.157.0.8103.38 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121219")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.