CVE-2026-121203: Google Chrome vulnerability

1. In CISA KEV: not seen
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not establishedNothing in the sources we check

DescriptionNVD

Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

Use After Free · Memory Corruption

Vendor

Google

Published

November 2026

Band

Unlikely (under 1%), November 2026

• Ubuntu 26.04Not affectedchecked 15 Nov 07:30 UTC
• Ubuntu 24.04Not affectedchecked 15 Nov 07:30 UTC
• Ubuntu 22.04Not affectedchecked 15 Nov 07:30 UTC
• Debian 13Affected, no fix releasedchecked 15 Nov 07:30 UTC
• Debian 12Affected, no fix releasedchecked 15 Nov 07:30 UTC

1. 15 Nov
   Debian’s tracker lists Debian 12 as affected, with no fix released Debian
2. 15 Nov
   Debian’s tracker lists Debian 13 as affected, with no fix released Debian
3. 15 Nov
   Ubuntu’s tracker lists Ubuntu 22.04 as not affected Ubuntu
4. 15 Nov
   Ubuntu’s tracker lists Ubuntu 24.04 as not affected Ubuntu
5. 15 Nov
   Ubuntu’s tracker lists Ubuntu 26.04 as not affected Ubuntu
6. 15 Nov
   Ubuntu’s tracker lists Ubuntu stonking as not affected Ubuntu

• NVD entrynvd.nist.gov
• Vendor advisorychromereleases.googleblog.com
• CVE recordcve.org