Skip to main content
Apexward Pulse
Type Vulnerability

Google · Memory corruption

Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted…

1 sourceCVE-2026-121076CVE-2026-121135CVE-2026-121141+7 more

At a glance

Low
30-day window, from the last update
Possible~0.4% estimated chance of attack in 30 days
Evidence-weighted, not popularity
Signal

~0.4% estimated chance of attack in 30 days. Exploitation not confirmed.

Why Low

Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.

Briefing

There is no written leader briefing for this story yet. These questions come from the facts we hold.

Questions to ask IT

  • Do we run Google Chrome, and which versions?
  • If it is not yet patched, what mitigation is in place, and will the fix be done by 7 Dec?

Next steps

  1. Confirm whether this affects systems or suppliers in your estate

Summary

  • M-156, ChromeOS version 16836.32.0 (Browser version 156.0.8078.93）has rolled out to ChromeOS devices on the Stable channel.
  • CVE-2026-121076 has an estimated ~0.3% chance of attack in 30 days (27.3th percentile) as of 2026-11-06 — probability signal, not confirmed exploitation

Read the original reportChrome Releases(opens in a new tab)

Products and services involved

4 reports

Part of The New Social Engineering Playbook Starts With Reconnaissance

Pulse

Last change yesterday · Recheck overdue since 8 Nov 2026, 02:32 UK time

  1. Story7 Nov 2026, 02:32 UK time · yesterday

    Linked reporting from Chrome Releases (vendor psirt).

    Read source (Chrome Releases)

1 entry so far. The timeline chart appears once this story has more history.

Sources

How we know

Statements extracted from sources. Higher confidence means stronger corroboration.

  • ClaimedHeadline60% confidence

    Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted…

  • ProbableSummary fact75% confidence

    M-156, ChromeOS version 16836.32.0 (Browser version 156.0.8078.93）has rolled out to ChromeOS devices on the Stable channel. If you find new issues, please let us know one of the following ways: File a bug Visit our ChromeOS communities

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-121076

  • ConfirmedEstimated attack likelihood95% confidence

    CVE-2026-121076 has an estimated ~0.3% chance of attack in 30 days (27.3th percentile) as of 2026-11-06 — probability signal, not confirmed exploitation

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-121135

  • ConfirmedEstimated attack likelihood95% confidence

    CVE-2026-121135 has an estimated ~0.3% chance of attack in 30 days (17.1th percentile) as of 2026-11-06 — probability signal, not confirmed exploitation

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-121141

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-121184

  • ConfirmedEstimated attack likelihood95% confidence

    CVE-2026-121184 has an estimated ~0.4% chance of attack in 30 days (29.8th percentile) as of 2026-11-06 — probability signal, not confirmed exploitation

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-121201

  • ConfirmedEstimated attack likelihood95% confidence

    CVE-2026-121201 has an estimated ~0.4% chance of attack in 30 days (31th percentile) as of 2026-11-06 — probability signal, not confirmed exploitation

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-121208