What is the CVSS score of CVE-2026-12010?

CVE-2026-12010 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-12010?

A sandbox escape vulnerability in Google Chrome on Android prior to version 149.0.7827.115 could allow attackers to escalate browser compromise into full device control.. A patch is available.

How to fix or mitigate CVE-2026-12010?

Within 24 hours: Identify all Android devices running Chrome and assess current version distribution against Chrome 149.0.7827.115. Within 7 days: Execute deployment of Chrome 149.0.7827.115 or later to all Android endpoints. Within 30 days: Complete patch deployment verification and audit device inventory for ongoing compliance.

Google Chrome CVE-2026-12010

EUVD-2026-36331 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-11 Chrome

GHSA-7mrw-37c7-gw8p

Buffer Overflow Google Heap Overflow Suse

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered via crafted page (AV:N, UI:R); AC:H because a prior renderer compromise is required; PR:N as no auth needed; S:C and C/I/A:H reflect sandbox escape to GPU process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 02:23 vuln.today

CVSS changed

Jun 12, 2026 - 02:22 NVD

8.3 (HIGH)

CVSS changed

Jun 12, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 11, 2026 - 20:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 11, 2026 - 20:48 cve.org

HIGH 8.3

DescriptionCVE.org

Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers a heap buffer overflow in the GPU process. Chromium rates this severity Critical, and while no public exploit identified at time of analysis, the bug is part of a classic two-stage exploitation chain typically used in browser zero-day exploits. Patch is available from vendor in Chrome 149.0.7827.115 and later.

Technical ContextAI

The flaw is a CWE-122 heap-based buffer overflow inside Chrome's GPU process on Android. Chrome's multi-process architecture isolates web content in a low-privilege renderer; the GPU process runs at higher privilege and handles graphics command buffers, shaders, and texture data marshalled from renderers via Mojo IPC. A memory-corruption bug in this trust boundary lets a malicious renderer corrupt GPU-process heap memory and pivot out of the renderer sandbox into the GPU process, which on Android has broader access to device resources (GPU drivers, shared memory, SurfaceFlinger). The CPE cpe:2.3:a:google:chrome covers the Chrome browser product line, with the Android build specifically affected.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.115 - update Chrome for Android to 149.0.7827.115 or later via Google Play, which is the only durable fix. Enterprises managing fleet devices should push the update through MDM and verify rollout in chrome://version on a sample device. As compensating controls until the update lands, restrict high-risk users to non-Chromium browsers or to Chrome with GPU acceleration disabled (chrome://flags 'Override software rendering list' set to disable hardware acceleration), accepting the trade-off of significantly degraded rendering performance and battery life; site-isolation policies and network-level blocking of untrusted sites further reduce the chance a renderer compromise even reaches this code path. Reference advisories: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html and https://nvd.nist.gov/vuln/detail/CVE-2026-12010.