External risk intelligence

Chrome Prerender Use After Free Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-121035

This vulnerability affects a client-side web browser. While it requires a user to interact with a crafted HTML page, the vulnerability exists within the browser software installed on an endpoint rather than as a public-facing network service, appliance, or infrastructure component reachable over the internet in a standard deployment.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Google Chrome's Prerender component could allow attackers to execute code remotely through specially crafted web pages. This issue, rated as critical due to its potential for widespread impact, underscores the need to monitor browser security and user interaction with web content. The primary concern is to confirm if this specific vulnerability is relevant and present within the organization's environment.

Code execution flaw in Chrome browser.
Affects user interaction with web pages.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

A remote attacker could trick a user into visiting a malicious webpage, which then triggers a flaw in Chrome's Prerender feature. This vulnerability, a use-after-free error, can lead to the execution of arbitrary code beyond the browser's security boundaries.

Entry condition: User visits a malicious website.
Trigger point: Vulnerable Prerender feature.
Resulting risk: Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Chrome's Prerender feature could allow a remote attacker to execute arbitrary code outside the sandbox when a user visits a specially crafted HTML page. This could potentially impact the confidentiality, integrity, and availability of the affected system when this feature is enabled and utilized.

Arbitrary code execution outside sandbox.
User visits crafted HTML page.
Compromised system integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Google Chrome's Prerender component, indicating that teams responsible for endpoint security and application management should take the lead. The initial focus must be on identifying all instances of the affected browser version, confirming their exposure and criticality, and then coordinating remediation efforts, which may involve vendor coordination for browser updates.

Identify affected Chrome instances.
Verify user interaction exposure.
Plan browser update deployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Prerender component in Google Chrome?

Prerender is a performance feature in the Chrome browser that loads web pages in the background before a user actually clicks on them. By pre-loading content, the browser aims to make navigation feel faster and more responsive. This vulnerability involves how the browser manages the memory associated with these background tasks.

What does use-after-free mean for CVE-2026-121035?

This is a memory management weakness, classified as CWE-416. It occurs when software continues to use a pointer to a memory location after that memory has been cleared or freed. In the context of this CVE, an attacker can manipulate this flaw to inject and execute their own code, potentially bypassing the browser's security sandbox.

How is the vulnerability triggered?

The flaw is triggered when a user navigates to a specifically crafted HTML page designed to exploit the Prerender memory error. It does not trigger automatically through background network activity; it requires the user to visit a malicious or compromised website that interacts with the browser's rendering process.

Is my system at risk from this Chrome vulnerability?

According to Halo Surface Signal, this vulnerability is very unlikely to pose a high risk because it is a client-side issue, not a public-facing network service. It relies on a user visiting a site, meaning it is not a direct target for automated internet scanning like a server-side bug might be.

What should I do if I use Google Chrome?

You should verify the version of Chrome installed on your devices to determine if they are older than 157.0.8103.38. If they are, you need to update the browser to the latest stable version provided by the vendor. Prioritizing updates on systems that frequently access untrusted web content is a standard best practice.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.