CVE-2026-121185

Summary

A use-after-free vulnerability in Chrome's PictureInPicture feature allows remote attackers to execute arbitrary code outside the sandbox by tricking users into visiting a malicious page.

Exploitability

Exploitation requires social engineering to lure a user to a crafted HTML page; no authentication or special privileges are needed.

Blast radius

Successful exploitation could lead to full system compromise via sandbox escape, enabling attackers to steal data, install malware, or pivot laterally.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Google Chrome to version 157.0.8103.38 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.