CVE-2026-121048

Summary

A race condition in Google Chrome's V8 JavaScript engine before version 157.0.8103.38 allowed a remote attacker to escape the sandbox and execute arbitrary code by exploiting a timing vulnerability during concurrent JIT compilation.

Exploitability

Exploitation requires a user to visit a malicious webpage; no authentication or special privileges are needed, but successful exploitation depends on reliably triggering the race condition in a short window.

Blast radius

Successful exploitation would allow an attacker to run arbitrary code with the same privileges as the compromised Chrome process, potentially leading to full system compromise if combined with further exploits.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Google Chrome to version 157.0.8103.38 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.