Threat level Severe
Contact
Critical 9.6
CVE-2026-121241

Google Chrome — remote code execution.

Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

WeaknessCWE-416: Use-after-free
Published Updated Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.6
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Exploit chance, 30 days
Not scored yet
EPSS scores new CVEs within a day or two
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

What to do

  1. 01Check whether you run Google Chrome, and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD
  2. NVD record updated

Also actively exploited

CVE-2026-1185274.3Ivanti Connect SecureCVE-2026-1199778.1WordPress WordPress CoreCVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
Vendor
Google108 CVEs in 30 days
All Google CVEs

Other CVEs in Google Chrome

40+ more CVEs

All Google Chrome CVEs
9.6Google Chrome — remote code execution.9.6Google Chrome — remote code execution.9.6Google Chrome — remote code execution.9.6Google Chrome — remote code execution.9.6Google Chrome — remote code execution.9.6Google Chrome — remote code execution.