What is the CVSS score of CVE-2026-12023?

CVE-2026-12023 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-12023?

Google Chrome on macOS (versions prior to 149.0.7827.115) contains a vulnerability enabling attackers to break out of the browser sandbox and access underlying system resources once they gain control…. A patch is available.

How to fix or mitigate CVE-2026-12023?

Initiate an inventory within 24 hours to identify all macOS endpoints running Google Chrome and determine which systems are running versions prior to 149.0.7827.115. Within 7 days, deploy Chrome 149.0.7827.115 or later across your macOS environment through established patch management processes, prioritizing endpoints with user access. Validate full remediation within 30 days by confirming through endpoint telemetry that no vulnerable Chrome versions remain deployed, and update vulnerability records to mark this CVE as resolved.

Google Chrome CVE-2026-12023

EUVD-2026-36343 HIGH

Use After Free (CWE-416)

2026-06-11 Chrome

GHSA-gpgj-gwjp-8vm9

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

PR:H because exploitation presumes an already-compromised renderer foothold; AC:H for the memory race and UI:R for the crafted page; S:C reflects the sandbox escape to a higher-privilege process.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:06 vuln.today

CVE Published

Jun 11, 2026 - 20:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 11, 2026 - 20:48 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in GPU in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on macOS (versions prior to 149.0.7827.115) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that triggers a use-after-free in the GPU component. This is a chain-stage bug rather than a standalone entry point - it presumes prior renderer compromise - and Google rates the Chromium severity as High. No public exploit identified at time of analysis, and the EPSS probability is low (0.07%, 21st percentile).

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's GPU process, which handles graphics acceleration, WebGL, canvas, and compositing work on behalf of untrusted web content. In Chrome's multi-process security model the renderer runs sandboxed and communicates with the more-privileged GPU process over Mojo IPC; a memory-lifetime bug (freed object still referenced) in the GPU-side handling of that IPC or of crafted rendering commands lets a compromised renderer corrupt GPU-process memory. Because the GPU process runs at higher privilege than the renderer sandbox, controlling it constitutes a sandbox escape. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and is specific to the macOS build per the CVE description.

RemediationAI

Vendor-released patch: update Google Chrome on macOS to 149.0.7827.115 or later via the Chrome Stable channel; verify by restarting the browser and checking chrome://settings/help, and confirm the update in the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html. In managed fleets, push the update through your MDM/Chrome Browser Cloud Management to ensure the auto-update completes. If immediate patching is not possible, reduce exposure by disabling hardware-accelerated GPU rendering (chrome://settings 'Use graphics acceleration when available' off, or the HardwareAccelerationModeEnabled policy) to shrink the GPU-process attack surface - with the trade-off of degraded rendering/video performance and higher CPU use - and enforce Chrome's site isolation and strict site engagement to raise the bar on the prerequisite renderer compromise. These are compensating controls only; the reliable fix is the version upgrade.