CVE-2026-121089

Summary

A use-after-free vulnerability in WebGPU within Google Chrome allowed remote attackers to execute arbitrary code outside the sandbox by manipulating freed memory after a page was rendered.

Exploitability

Exploitation requires a targeted user to visit a crafted HTML page, leveraging social engineering or compromised websites due to the need for user interaction (UI:R).

Blast radius

Successful exploitation could lead to full system compromise outside Chrome's sandbox, enabling data theft, malware installation, or lateral movement within the host environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Google Chrome to version 157.0.8103.38 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.