What is the CVSS score of CVE-2026-12028?

CVE-2026-12028 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-12028?

Google Chrome for Android contains a sandbox escape vulnerability (CVE-2026-12028) that could allow attackers to escalate from a compromised renderer process to higher-privileged code execution.. A patch is available.

How to fix or mitigate CVE-2026-12028?

Within 24 hours, inventory Chrome deployments on managed Android devices and verify patch availability. Within 7 days, deploy Google Chrome for Android version 149.0.7827.115 or later to all managed devices through MDM and communicate urgency to end users to manually update unmanaged devices. Within 30 days, complete patch verification across the Android fleet and establish monitoring for exploitation attempts.

Google Chrome CVE-2026-12028

EUVD-2026-36348 HIGH

Use After Free (CWE-416)

2026-06-11 Chrome

GHSA-f5m3-mrhf-6cqv

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H and UI:R because exploitation needs specific GPU memory grooming plus victim visiting a page; PR:N per Chromium model though a prior renderer compromise is effectively required; S:C for the sandbox escape with total C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:05 vuln.today

CVE Published

Jun 11, 2026 - 20:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 11, 2026 - 20:48 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in the GPU process of Google Chrome for Android before 149.0.7827.115 lets a remote attacker who has already compromised the renderer process break out of the sandbox and potentially achieve code execution in a higher-privileged context via a crafted HTML page. This is a memory-corruption (use-after-free) bug rated High by Chromium and fixed in the June 2026 stable channel; there is no public exploit identified at time of analysis and EPSS is very low (0.07%), but the total technical impact makes it a meaningful second-stage primitive in a browser exploit chain.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's GPU process, the component that handles graphics acceleration, WebGL/WebGPU, and compositing on behalf of web content. In Chromium's multi-process architecture the renderer is untrusted and sandboxed, while the GPU process runs at higher privilege; a dangling pointer freed and then reused in the GPU process can be groomed by an attacker who controls the renderer to corrupt memory across the sandbox boundary. The affected CPE is cpe:2.3:a:google:chrome, and the underlying class - freeing an object while references remain live - is a recurring source of exploitable browser vulnerabilities because reclaimed memory can be filled with attacker-controlled data before the stale pointer is dereferenced.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.115 or later, which contains the fix per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html); on Android this arrives through the Google Play Store / Chrome auto-update, so ensure automatic app updates are enabled and force-update managed fleets via MDM. SUSE and Red Hat users should apply their distribution's Chromium package update once published. As an interim compensating control where patching is delayed, you can reduce the GPU attack surface by disabling hardware acceleration in Chrome settings (chrome://settings, 'Use graphics acceleration when available' off), which forces software rendering and limits GPU-process object churn - with the trade-off of higher CPU use and degraded WebGL/WebGPU and video performance. Because exploitation requires a prior renderer compromise, keeping Chrome fully updated also closes the renderer bugs needed to reach this one.