Chrome 9.6 CVE — What “No Login Needed” Actually Means (And What It Doesn’t)

Your scanner dashboard is going to show CVE-2026-121114 at the top this week. CVSS 9.6. Chrome. TabStrip use-after-free. Remote code execution outside the sandbox.

Here’s what the score doesn’t tell you.

The vector: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Remote ✓ No login needed ✓ Sandbox escape ✓

Also: UI:R — the victim has to open a crafted HTML page.

This is not a worm. It’s a phishing delivery problem. Someone has to click.

Google’s own rating is High, not Critical. The 9.6 comes from CISA’s ADP Vulnrichment, not Google’s CNA. CVSS measures worst-case impact. Google measures exploitation likelihood. Both are right.

What to do:

Update Chrome to 157.0.8103.38 (Linux) / 157.0.8103.38/.39 (Windows, macOS)
If you manage a fleet — force the update through MDM. Staged rollout means chrome://version can show 156 while reporting “up to date”
Restart Chrome after update — it won’t apply until you do
Check Android separately (same build: 157.0.8103.38)

TabStrip side note: This is the 5th TabStrip UAF in Chrome in 2026. Same component, same bug class, every few months. Browser patch cadence matters more than any single CVE.

Full breakdown with hunt checklist: https://threataft.com/articles/cve-2026-121114-chrome-tabstrip-use-after-free