Google Chrome: use after free in PictureInPicture (CVE-2026-121185)
CVE-2026-121185 has been published for Google Chrome: a use-after-free in the PictureInPicture component. A remote attacker using social engineering and a crafted HTML page could execute arbitrary code outside the sandbox.
Checked in Shield: no
Who is affected
Google Chrome versions prior to 157.0.8103.38 are affected. Chromium rates the severity High, CVSS 9.6. The source does not say whether other Chromium builds are affected.
How to check
Open chrome://version and compare the version with 157.0.8103.38. If chromium is installed on a server, check what it is used for and whether it opens untrusted pages.
How to fix
A fix exists: version 157.0.8103.38 for Chrome. Update the browser. For the Debian chromium package, watch the security tracker. If chromium is not needed, remove it.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the flaw is exploited in the wild is not disclosed yet. Source: NVD.
