Google Chrome: use after free in PerformanceAPIs (CVE-2026-121188)
CVE-2026-121188 has been published for Google Chrome: a use after free in PerformanceAPIs. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
Checked in Shield: no
Who is affected
Google Chrome versions prior to 157.0.8103.38 are affected. CVSS score is 8.8, Chromium security severity: High.
How to check
Check the installed Chrome or Chromium version. If it is lower than 157.0.8103.38, it is vulnerable. On servers, find out whether chromium is used and whether it opens external pages.
How to fix
A fix exists: version 157.0.8103.38. Update the browser. For the Debian chromium package, watch for security updates and install them when released. If chromium is not needed, consider removing it.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the issue is exploited in attacks is not disclosed yet. Source: NVD.
