7.5
High
CVE-2026-121217 Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary…
Description
Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low)
CVSS 3.1 detail
Vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitable from the adjacent network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Adjacent network
- Attack complexity
- High
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Chrome 157.0 | earliest → < 157.0.8103.38 | 157.0.8103.38 |
Other CVEs of Chrome
The 6072 CVEs of Chrome →
CVE-2026-120930
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web…
5.4
Medium
CVE-2026-120931
Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to…
9.6
Critical
CVE-2026-121195
Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass…
8.8
High
CVE-2026-121141
Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…
5.4
Medium