What is the CVSS score of CVE-2026-12012?

CVE-2026-12012 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-12012?

Google Chrome versions prior to 149.0.7827.115 contain a high-severity heap corruption vulnerability allowing code execution within the browser process.. A patch is available.

How to fix or mitigate CVE-2026-12012?

Within 24 hours, inventory Chrome deployments organization-wide and confirm current versions; initiate communication to notify stakeholders of the mandatory update requirement. Within 7 days, deploy Chrome version 149.0.7827.115 or later across all systems through your standard update mechanism (auto-update, WSUS, MDM, or manual deployment). Within 30 days, audit patch compliance to verify 100% of Chrome installations are at the patched version and document remediation completion for audit records.

Google Chrome CVE-2026-12012

EUVD-2026-36333 HIGH

Use After Free (CWE-416)

2026-06-11 Chrome

GHSA-fjgw-6f88-3w3x

Denial Of Service Google Use After Free Memory Corruption

8.1

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-delivered but requires a privileged on-path position and heap-grooming reliability (AV:N, AC:H); no auth or user interaction (PR:N/UI:N); memory corruption yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:08 vuln.today

CVE Published

Jun 11, 2026 - 20:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 11, 2026 - 20:48 cve.org

HIGH 8.1

DescriptionCVE.org

Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network position to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Network component (versions prior to 149.0.7827.115) allows an attacker in a privileged network position to trigger a use-after-free via malicious network traffic, potentially leading to memory corruption and code execution within the browser process. Google rates the Chromium severity as High, and a fixed stable-channel build is available. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.02%), while CISA's SSVC framework records exploitation status as none.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Network stack, the subsystem that parses and processes protocol data (HTTP responses, sockets, and related network primitives) built on Chromium. A use-after-free occurs when memory is freed but a dangling pointer is later dereferenced; in a browser networking path this typically arises from object lifetime mismanagement during asynchronous request/response handling. Because the affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, all Chrome desktop builds before 149.0.7827.115 are in scope, and Chromium-derived browsers sharing the same network code may also be affected though they are not enumerated here.

RemediationAI

Apply the vendor fix by upgrading to Google Chrome 149.0.7827.115 or later on all desktop platforms (Vendor-released patch: 149.0.7827.115), per the Chrome stable-channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html; restart the browser to complete the update since Chrome staged updates do not take effect until relaunch. Where immediate patching is not possible, reduce exposure to the privileged-network-position precondition by avoiding untrusted networks and enforcing HTTPS/HSTS and VPN usage to limit an on-path attacker's ability to inject malicious traffic, accepting that these controls mitigate but do not eliminate the flaw. Organizations should also confirm Chromium-based browsers in their fleet have pulled the equivalent upstream fix.