{"id":"CVE-2026-121256","kind":"vulnerability","aliases":["CVE-2026-121256"],"related":[],"title":"Chrome: GPU use-after-free lets a compromised renderer escape its sandbox","description":"Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","summary":"A use of a released resource in Chrome's GPU component lets a remote attacker who already controls the renderer process potentially run code outside the browser sandbox. The attacker must deliver a crafted HTML page, and the sources rate it Medium severity in Chromium.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","chrome","endpoints","runtime"],"not_affected_if":["chrome-updated"],"how_to_check":"- Open Chrome and check the version under Settings > About Chrome, or run `google-chrome --version` on Linux.\n- Confirm the version is below `157.0.8103.38`.","fix":"- Google Chrome: update to `157.0.8103.38` or later.","status":"open","published_at":"2026-11-03T21:17:36+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","triaged_at":"2026-11-03T21:20:53+00:00","updated_at":"2026-11-03T21:20:53+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-03T21:20:53Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: update to `157.0.8103.38` or later.","reach":"internet","title":"Chrome: GPU use-after-free lets a compromised renderer escape its sandbox","impact":"high","summary":"A use of a released resource in Chrome's GPU component lets a remote attacker who already controls the renderer process potentially run code outside the browser sandbox. The attacker must deliver a crafted HTML page, and the sources rate it Medium severity in Chromium.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","browsers","endpoints"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs code outside the browser sandbox on the device","analyst_note":"","how_to_check":"- Open Chrome and check the version under Settings > About Chrome, or run `google-chrome --version` on Linux.\n- Confirm the version is below `157.0.8103.38`.","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: Chrome menu > Help > About Google Chrome.","needs_analyst":false,"not_affected_if":["chrome-updated"],"who_is_affected":"Any desktop or mobile install of Google Chrome older than 157.0.8103.38 is exposed when a user visits a malicious page. Managed fleets should check browser versions across endpoints. unknown for Chromium-based browsers that ship their own build cycle.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":4113,"output_tokens":542,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121256':16A,19A '-2026':15A,18A '157.0.8103.38':80C 'allow':81C 'alreadi':40B 'arbitrari':94C 'attack':38B,53B,84C 'browser':20B,50B 'chrome':1A,21B,31B,77C 'chromium':68B,104C 'code':47B,95C 'compon':34B 'compromis':9A,87C 'control':41B 'craft':57B,101C 'cve':14A,17A 'deliv':55B 'endpoint':22B 'escap':11A 'execut':93C 'free':6A 'googl':76C 'gpu':2A,33B,74C 'html':58B,102C 'let':7A,35B 'medium':65B,107C 'must':54B 'outsid':48B,96C 'page':59B,103C 'potenti':45B,92C 'prior':78C 'process':44B,90C 'rate':63B 'releas':28B,71C 'remot':37B,83C 'render':10A,43B,89C 'resourc':29B,72C 'run':46B 'runtim':23B 'sandbox':13A,51B,98C 'secur':105C 'sever':66B,106C 'sourc':62B 'use':4A,25B,69C 'use-after-fre':3A 'via':99C","nicknames":[],"mitigations":[],"who_affected":"Any desktop or mobile install of Google Chrome older than 157.0.8103.38 is exposed when a user visits a malicious page. Managed fleets should check browser versions across endpoints. unknown for Chromium-based browsers that ship their own build cycle.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.38 or later: Chrome menu > Help > About Google Chrome.","pkeys":[],"ptokens":[],"labels":["browsers","chrome","endpoints","medium","runtime"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121256","severity":null,"published_at":"2026-11-03T21:17:36+00:00","modified_at":"2026-11-03T21:17:36+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","fetched_at":"2026-11-03T21:19:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}