Live › vulnerability › CVE-2026-121257
A use-after-free bug in the TabStrip component of Google Chrome before 157.0.8103.38 can be triggered by a crafted Chrome extension. A remote attacker could potentially execute arbitrary code outside the browser sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Anyone running Google Chrome before 157.0.8103.38, including desktop browsers on managed or personal machines. The sources describe exploitation through a crafted Chrome extension, so exposure depends on the browser build and not on any server configuration.
No product ranges from the sources yet.
chrome --version on the machine where Chrome is installed.157.0.8103.38.157.0.8103.38 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121257")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.