CVE-2026-126899
A NVD · · CVE-2026-126899
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- EPSS
- 0%
Key insight
The advisory contains no indication of active exploitation, PoC code, or a campaign and therefore does not go beyond pure patch information.
Description
CVE-2026-126899 affects Google Chrome before version 157.0.8103.78. The vulnerability is a use-after-free in Elements and can be exploited by a remote attacker through a specially crafted HTML page. The attacker must use social engineering to persuade the victim to open the page. Successful exploitation allows arbitrary code execution inside the Chrome sandbox. Chromium rates the security severity as High; the advisory does not mention active exploitation or KEV inclusion.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 0.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational