What is the CVSS score of CVE-2026-12035?

CVE-2026-12035 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-12035?

Google Chrome on Windows contains a critical browser-level vulnerability (CVE-2026-12035) that could allow attackers to compromise the browser process if employees visit a crafted malicious website.. A patch is available.

How to fix or mitigate CVE-2026-12035?

Within 24 hours, audit Chrome deployment across all Windows endpoints and prepare user communications for the patch. Within 7 days, deploy Google Chrome version 149.0.7827.115 or later to all affected Windows systems through your patch management system, prioritizing users with regular exposure to external web content. Within 30 days, verify patch deployment completion above 95% and confirm automatic update mechanisms remain enabled to prevent version regression.

Google Chrome CVE-2026-12035

EUVD-2026-36355 HIGH

Use After Free (CWE-416)

2026-06-11 Chrome

GHSA-mj36-6c8f-m4mw

Denial Of Service Google Use After Free Memory Corruption Microsoft

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N) with no privileges (PR:N) but mandatory user navigation (UI:R); renderer-process memory corruption yields high C/I/A within an unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:03 vuln.today

CVE Published

Jun 11, 2026 - 20:48 cve.org

HIGH 8.8

CVE Published

Jun 11, 2026 - 20:48 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's Views UI framework on Windows (versions prior to 149.0.7827.115) lets a remote attacker exploit a use-after-free by luring a victim to a crafted HTML page. Google rates the Chromium severity High, and the CVSS 8.8 vector reflects full compromise of the renderer/browser process, though exploitation requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis and EPSS is very low (0.03%), indicating no observed weaponization yet.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Views component, the C++ UI toolkit Chromium uses to build browser windows, menus, dialogs, and other on-screen widgets on desktop platforms. A use-after-free arises when a Views object is destroyed while a pointer to it remains live, so later access dereferences freed heap memory; an attacker who controls heap layout via a crafted HTML page can reclaim that freed slot with attacker-controlled data, turning dangling-pointer access into controlled heap corruption. The affected CPE is cpe:2.3:a:google:chrome (all versions before the fixed 149.0.7827.115), and the issue is specific to the Windows build per the description.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.115 or later on Windows via the Stable channel; Chrome typically auto-updates, so ensure the browser is fully closed and relaunched to apply, and verify the version under chrome://settings/help. See the Chrome release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html. If patching must be delayed in a managed fleet, reduce exposure by restricting browsing to trusted sites through enterprise policy or web proxy/URL filtering and by enforcing Site Isolation (on by default) so a renderer compromise is harder to leverage - the trade-off is reduced user flexibility and increased memory usage; these are only stopgaps and do not remove the underlying bug, so prioritize deploying the fixed build across all endpoints.