What is the CVSS score of CVE-2026-12013?

CVE-2026-12013 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-12013?

A vulnerability in Google Chrome on Windows could enable attackers to breach individual user systems and access corporate data and systems through malicious webpages, without requiring user…. A patch is available.

How to fix or mitigate CVE-2026-12013?

Within 24 hours, initiate deployment of Google Chrome version 149.0.7827.115 or later to a pilot group representing 10-20% of your Windows user base to validate compatibility and functionality. Within 7 days, complete the rollout to all remaining Windows workstations, prioritizing those in high-risk groups such as employees accessing external websites or handling sensitive information. By 30 days, confirm 100% patch coverage across your environment, enable automatic updates for Chrome, and conduct a review of endpoint logs from the past 30 days to identify any signs of exploitation attempts.

Google Chrome CVE-2026-12013

EUVD-2026-36334 HIGH

Use After Free (CWE-416)

2026-06-11 Chrome

GHSA-rx7p-7m6r-qmjg

Denial Of Service Google Use After Free Memory Corruption Microsoft

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no auth (PR:N) but requires the victim to load it (UI:R); a renderer use-after-free yields high C/I/A within process scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:08 vuln.today

CVE Published

Jun 11, 2026 - 20:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 11, 2026 - 20:48 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Media in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption via a use-after-free in the Media component of Google Chrome on Windows before 149.0.7827.115 allows a remote attacker to potentially achieve code execution when a victim opens a crafted HTML page. Rated High by Chromium with CVSS 8.8, it requires user interaction (loading a malicious page) but no authentication. There is no public exploit identified at time of analysis, EPSS is low (0.07%), and CISA SSVC lists exploitation as none.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Media subsystem, which handles audio/video decoding, playback pipelines, and related buffer management. A use-after-free occurs when memory is freed but a dangling pointer is subsequently dereferenced, letting an attacker who controls heap layout (via crafted media content in an HTML page) corrupt the heap and potentially hijack control flow. The affected code runs inside the Chrome renderer/media process; the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the Chrome application itself is affected, with this issue scoped to the Windows build per the description.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.115 or later on Windows via the Stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html); relaunch the browser to apply the update, since Chrome patches only take effect after restart. In managed environments, push the update through enterprise update policies or software distribution tooling and verify the reported version. If immediate patching is not possible, reduce exposure by avoiding untrusted sites and disabling autoplay/rich media where feasible, and keep site isolation and sandboxing enabled - the trade-off is reduced media functionality and no guarantee against a determined exploit, so patching remains the only reliable fix.