Description
Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-11-03
Score: 9.6 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw in Chrome’s Prerender component allows a crafted HTML page to trigger the vulnerability, resulting in arbitrary code execution outside the browser sandbox. The flaw compromises both confidentiality and integrity by giving the attacker real system privileges. The weakness is classified as CWE‑416.

Affected Systems

Google Chrome versions prior to 157.0.8103.38 are affected. Any installation using an earlier stable channel that has not received the 157.0.8103.38 update is at risk.

Risk and Exploitability

The CVE is scored as Critical by Chromium, but no EPSS value is available and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw by delivering a malicious HTML page to a user’s browser, either via a compromised site or malicious email. Until patched, the vulnerability represents a high exploitation risk due to its remote nature and privilege escalation potential.

Generated by OpenCVE AI on November 3, 2026 at 23:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 157.0.8103.38 or later, which includes the fix for the Prerender use‑after‑free issue.
  • Launch Chrome with the --disable-prerender flag, or configure the GPO/set Chrome policy to disable prerendering, to mitigate the flaw until the update is available.
  • Employ network or endpoint security controls to block or monitor malicious HTML content that could exploit the vulnerability, such as using a Web Application Firewall or endpoint detection and response.

Generated by OpenCVE AI on November 3, 2026 at 23:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 23:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Prerender Allows Remote Code Execution

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Tue, 03 Nov 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 03 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:32:12.294Z

Reserved: 2026-11-03T09:23:07.180Z

Link: CVE-2026-121035

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-03T21:17:06.730

Modified: 2026-11-03T22:19:32.430

Link: CVE-2026-121035

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T23:30:06Z

Weaknesses