What is the CVSS score of CVE-2026-12020?

CVE-2026-12020 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google are affected by CVE-2026-12020?

Google Chrome on macOS contains a heap corruption vulnerability in the Autofill component (CVE-2026-12020) that enables arbitrary code execution through malicious websites, with no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-12020?

Within 24 hours, inventory all macOS systems running Google Chrome and identify those on versions prior to 149.0.7827.115, prioritizing machines with high-value users or stored corporate credentials. Within 7 days, deploy Chrome version 149.0.7827.115 or later via auto-update or manual installation across all affected macOS systems, ensuring administrators without auto-update enabled receive mandatory patching instructions. Within 30 days, audit device management platforms to confirm all macOS Chrome deployments report version 149.0.7827.115 or later, and document remediation completion for compliance records.

Google CVE-2026-12020

EUVD-2026-36341 HIGH

Use After Free (CWE-416)

2026-06-11 Chrome

GHSA-56gw-7mmr-w2pf

Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:06 vuln.today

CVE Published

Jun 11, 2026 - 20:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 11, 2026 - 20:48 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Autofill component on macOS (versions prior to 149.0.7827.115) lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution in the renderer. Google rates the Chromium severity as High and has shipped a fix in the stable channel. There is no public exploit identified at time of analysis, and EPSS is very low at 0.07%.