What is the CVSS score of CVE-2026-12034?

CVE-2026-12034 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google are affected by CVE-2026-12034?

Google Chrome on Linux versions prior to 149.0.7827.115 contain a high-severity sandbox escape vulnerability that enables attackers who have compromised the browser renderer process to escalate to…. A patch is available.

How to fix or mitigate CVE-2026-12034?

Within 24 hours, inventory all Linux systems running Google Chrome and identify those below version 149.0.7827.115. Within 7 days, deploy Chrome 149.0.7827.115 or later to all affected Linux systems through your standard patch management process, prioritizing systems with sensitive data or developer access. Within 30 days, verify 100% deployment coverage through automated scanning and confirm no systems remain on vulnerable versions.

Google CVE-2026-12034

EUVD-2026-36354 HIGH

Improper Input Validation (CWE-20)

2026-06-11 Chrome

GHSA-cc2r-m9h8-v7mj

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:03 vuln.today

CVE Published

Jun 11, 2026 - 20:48 cve.org

HIGH 8.3

CVE Published

Jun 11, 2026 - 20:48 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Linux (versions prior to 149.0.7827.115) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a malicious file, through insufficient input validation in the Linux Toolkit (GTK) Theming component. Rated High severity by Chromium and CVSS 8.3, this is a second-stage escalation primitive rather than an initial entry point. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%, 21st percentile), with CISA SSVC scoring exploitation as 'none'.