SECURITYHIGHCVE-2026-121034

CVE-2026-121034: Google Chrome Views Use-After-Free on Windows Enables Sandbox Escape

A use-after-free in Chrome's Views component on Windows before 157.0.8103.38 could allow code execution outside the sandbox via a crafted page.

Dylan H.

Security Team

November 4, 2026
2 min read
CVE-2026-121034: Google Chrome Views Use-After-Free on Windows Enables Sandbox Escape

Affected Products

  • Google Chrome on Windows versions prior to 157.0.8103.38

Overview

CVE-2026-121034 is a use-after-free in the Views component of Google Chrome on Windows. According to the NVD entry published November 3, 2026, a remote attacker who leverages social engineering could execute arbitrary code outside the sandbox via a crafted HTML page.

Chromium rates the issue High, and the NVD entry carries a CVSS score of 9.6. This article rates it High, following Chromium. It was disclosed alongside CVE-2026-121030, a DevTools authorization flaw fixed in the same Chrome release.

Technical Details

FieldValue
CVE IDCVE-2026-121034
ComponentViews
WeaknessUse after free
PlatformWindows
NVD CVSS9.6
Chromium severityHigh
Attack vectorCrafted HTML page plus social engineering
Fixed inChrome 157.0.8103.38

No exploitation in the wild is reported in the source material, and technical details beyond the NVD description are not public.

Remediation

  1. Update Chrome on Windows to 157.0.8103.38 or later and relaunch the browser.
  2. Update other Chromium-based browsers as vendors release the fix.
  3. Verify browser versions across managed Windows fleets through your endpoint management tooling.
  4. Remind users to be wary of pages that prompt unusual interactions.

References

  • NVD: CVE-2026-121034