What is the CVSS score of CVE-2026-12008?

CVE-2026-12008 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-12008?

Google Chrome versions prior to 149.0.7827.115 contain a critical sandbox escape vulnerability in the DigitalCredentials component that could allow attackers who have already compromised a browser…. A patch is available.

How to fix or mitigate CVE-2026-12008?

Within 24 hours, inventory Chrome installations across the organization and validate Chrome 149.0.7827.115 in your staging environment. Over the next 7 days, deploy this version organization-wide through your standard patch management process, prioritizing user-facing systems and endpoints with sensitive data access. Within 30 days, verify deployment completion through configuration management tools and audit security logs for indicators of compromise or exploitation attempts during the patching window.

Google Chrome CVE-2026-12008

EUVD-2026-36329 HIGH

Use After Free (CWE-416)

2026-06-11 Chrome

GHSA-qq7q-f996-8xmg

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered crafted page with UI:R and high complexity heap grooming; scope changes as the renderer-stage bug escalates to the browser process, yielding total C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:10 vuln.today

CVE Published

Jun 11, 2026 - 20:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 11, 2026 - 20:48 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's DigitalCredentials component (versions prior to 149.0.7827.115) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3, it is a use-after-free memory-corruption bug used as the second stage of an exploit chain. There is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is very low (0.07%), consistent with a fix shipped before disclosure.

Technical ContextAI

The flaw is CWE-416 (use-after-free) in Chromium's DigitalCredentials subsystem, the browser-side plumbing behind the W3C Digital Credentials API used to request and present verifiable/identity credentials (e.g. mobile driver's licenses) to web pages. A use-after-free occurs when memory is freed but a dangling reference is later dereferenced, allowing an attacker to reshape freed heap memory and hijack control flow or corrupt object state. Because DigitalCredentials logic runs across the renderer/browser boundary, a UAF here can be leveraged from a controlled renderer to execute code in the higher-privileged browser process, defeating the sandbox. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Google Chrome desktop application; the same code is shared by other Chromium-based browsers, which typically require separate vendor rebuilds.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.115 or later on the Stable desktop channel, then relaunch the browser to load the new build (per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html). In managed environments, push the update via your browser management policy and force a restart to guarantee the fix is active. Users of other Chromium-based browsers should install the vendor build that incorporates the corresponding Chromium fix. Because exploitation requires a prior renderer compromise, defense-in-depth against that first stage helps in the interim: enabling Chrome's Site Isolation (default) and Enhanced Safe Browsing raises the bar, and where policy permits, disabling the Digital Credentials API / not exposing identity-credential workflows removes the vulnerable surface at the cost of breaking sites that rely on that API. These are stopgaps only - patching is the definitive fix.