CVE-2026-121249

Summary

A heap-based buffer overflow in ANGLE (a Direct3D-to-OpenGL translation layer) within Google Chrome allowed remote attackers to execute arbitrary code outside the browser sandbox by tricking a user into visiting a malicious HTML page.

Exploitability

Exploitation requires user interaction (e.g., clicking a link or visiting a crafted webpage) and precise memory manipulation, making it moderately difficult despite the low attack complexity.

Blast radius

Successful exploitation could lead to full system compromise with no sandbox escape required, enabling data theft, malware installation, or lateral movement within the victim’s environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Google Chrome to version 157.0.8103.38 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.