Type Vulnerability
The Chrome team is delighted to announce the promotion of Chrome 157 to the stable channel for Windows, Mac and Linux.
Google · Memory corruption
Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page
CVE-2026-121095
What this means
The severity of this vulnerability has not been scored yet. There is no confirmed exploitation of it yet.
Full vendor description
Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Scoring and exploitation
Not reported
- ~0.2% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Not confirmed in the
- Not reported
Weaknesses
CWE-908
References
2 links from the CVE record, grouped by site.
chromereleases.googleblog.com1 link
issues.chromium.org1 link