Threat database

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-121227 is a high-severity vulnerability in Google Chrome's Skia component prior to version 157.0.8103.38. It involves an uninitialized resource that allows a remote attacker, who has already compromised the renderer process, to read memory outside the sandbox via a crafted HTML page. This vulnerability has been fixed in Chrome version 157.0.8103.38.

Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

A use-after-free vulnerability exists in the Canvas component of Google Chrome prior to version 157.0.8103.38. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and has been fixed in Chrome version 157.0.8103.38.

A use-after-free vulnerability in the Paint component of Google Chrome prior to version 157.0.8103.38 allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. This vulnerability has been assigned CVE-2026-121117 and is rated high severity with a CVSS score of 8.8. The issue has been fixed in Chrome version 157.0.8103.38.

A security vulnerability in Google Chrome Desktop on Mac prior to version 157.0.8103.38 allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. This issue has been fixed in version 157.0.8103.38.

Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

An uninitialized resource vulnerability in the Images component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to obtain cross-origin data via a crafted HTML page. This issue has been assigned a high severity by Chromium security. The vulnerability is fixed in Chrome version 157.0.8103.38.

Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

A vulnerability in Google Chrome on Mac prior to version 157.0.8103.38 allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. This issue is due to incorrect reference resolution in images. The flaw has been fixed in version 157.0.8103.38.

Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

A high-severity vulnerability in Google Chrome prior to version 157.0.8103.38 allows a remote attacker who has compromised the renderer process to read memory outside the sandbox via a crafted HTML page. The issue involves an uninitialized GPU resource. This vulnerability has been fixed in Chrome version 157.0.8103.38.

Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)