What is the CVSS score of CVE-2026-12011?

CVE-2026-12011 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-12011?

Google Chrome versions prior to 149.0.7827.115 contain a use-after-free vulnerability in WebMIDI that allows an attacker with an existing renderer-process compromise to escape the sandbox and…. A patch is available.

How to fix or mitigate CVE-2026-12011?

Within 24 hours, notify end-users and IT staff of the immediate availability of Chrome 149.0.7827.115 and establish communication channels to track rollout progress. Within 7 days, ensure Chrome auto-updates are enabled organization-wide or manually deploy version 149.0.7827.115 to all Windows endpoints; verify patch installation through your device management tools and audit logs. Within 30 days, review browser security policies (particularly MIDI API permissions) to restrict use-after-free attack surface on high-risk systems, and monitor Chromium security advisories for any related issues in other Chromium-based browsers (Edge, Brave, etc.) that may share this vulnerability.

Google Chrome CVE-2026-12011

EUVD-2026-36332 HIGH

Use After Free (CWE-416)

2026-06-11 Chrome

GHSA-p3m7-4j7v-27j4

Denial Of Service Google Use After Free Memory Corruption Microsoft

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered crafted page (AV:N, UI:R) with high complexity because a prior renderer compromise is required (AC:H); sandbox escape yields scope change (S:C) and full host impact (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:09 vuln.today

CVE Published

Jun 11, 2026 - 20:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 11, 2026 - 20:48 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in WebMIDI in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Use-after-free in Chrome's WebMIDI implementation on Windows lets a remote attacker who has already compromised the renderer process escape the sandbox via a crafted HTML page, elevating a renderer-level foothold toward host-level control. Rated Critical by Chromium and affecting all Chrome builds prior to 149.0.7827.115, the flaw has a patch available from Google but shows no public exploit identified at time of analysis and a very low EPSS of 0.06%.

Technical ContextAI

WebMIDI is the browser API (navigator.requestMIDIAccess) that exposes MIDI hardware and message routing to web content; its implementation spans the sandboxed renderer and the more privileged browser process. The root cause is CWE-416 (use-after-free): a MIDI-related object is freed while a dangling reference remains reachable, and subsequent access to that stale pointer corrupts memory. Because WebMIDI mediates between the renderer and higher-privilege components, a controlled use-after-free here becomes a lever for crossing the sandbox boundary rather than merely crashing the tab. The only CPE provided is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, and downstream repackaging is implied by the SUSE and Red Hat tags.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.115 or later via the Stable channel, as described in Google's advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html; restart the browser to ensure the update is applied since Chrome staged updates do not take effect until relaunch. For managed fleets, push the update through enterprise policy and verify the reported version in chrome://settings/help. There is no configuration workaround that fully removes the WebMIDI code path for normal browsing, but as an interim compensating control administrators can restrict WebMIDI exposure via enterprise policy and limit installation of untrusted extensions, and because exploitation requires a prior renderer compromise, keeping the site-isolation sandbox intact and blocking untrusted web content reduces the chained attack surface - with the trade-off that disabling MIDI features breaks legitimate web audio/MIDI applications.