What is the CVSS score of CVE-2026-12439?

CVE-2026-12439 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-12439?

Google Chrome users organization-wide face potential code execution risk from a heap corruption vulnerability in the Digital Credentials component affecting versions prior to 149.0.7827.155.. A patch is available.

How to fix or mitigate CVE-2026-12439?

Within 24 hours: Issue security advisory to all device owners; stage Chrome 149.0.7827.155 for deployment testing. Within 7 days: Deploy Chrome 149.0.7827.155 across all managed endpoints, prioritizing systems handling sensitive data. Within 30 days: Confirm deployment completion and verify zero non-compliant Chrome installations through asset inventory.

Google Chrome CVE-2026-12439

EUVD-2026-37524 HIGH

Use After Free (CWE-416)

2026-06-17 Chrome

Google Use After Free Memory Corruption Denial Of Service Red Hat Suse

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Drive-by web exploit needs only a page visit (AV:N, AC:L, PR:N, UI:R); renderer-process code execution gives high C/I/A within the sandboxed scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 04:53 vuln.today

CVSS changed

Jun 18, 2026 - 04:52 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Digital Credentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Heap corruption in Google Chrome's Digital Credentials component (versions prior to 149.0.7827.155) allows remote attackers to trigger a use-after-free condition by enticing a user to visit a crafted HTML page, potentially leading to arbitrary code execution within the renderer process. Chromium rates this issue as Critical severity, and Google has released a patched stable-channel build; no public exploit identified at time of analysis and EPSS sits at 0.31% (23rd percentile), indicating low predicted near-term exploitation pressure despite the high CVSS of 8.8.

Technical ContextAI

The flaw resides in Chrome's Digital Credentials API, the browser surface that lets websites request verifiable credentials (e.g., mobile driver's licenses, identity wallets) through the navigator.credentials interface backed by Chromium's content/browser credential management code. CWE-416 (Use After Free) means an object in the Digital Credentials handler is freed while a reference to it remains live; subsequent dereference operates on attacker-influenceable heap memory, enabling heap layout manipulation that can be steered toward type confusion or control-flow hijack. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all platforms shipping the Blink/Chromium renderer, and exploitation primitives in this subsystem typically execute inside the sandboxed renderer process - meaningful code execution outside the sandbox requires a separate sandbox-escape bug to chain.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.155 or later on Windows, macOS, and Linux via the stable channel update described in https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html; managed environments should force-push the update through Chrome Browser Cloud Management, Group Policy (RelaunchNotificationPeriod), or Jamf/Intune and verify by checking chrome://settings/help on endpoints. Operators of downstream Chromium-based browsers should apply the equivalent vendor build once it incorporates the Chromium milestone fix. Until patches are deployed, a targeted compensating control is to disable the Digital Credentials API surface where feasible - Chrome exposes this behind enterprise policy and origin-trial gating, so administrators can restrict it via the DigitalCredentialsEnabled-style policy or block the relevant origin trial tokens, accepting the trade-off that any legitimate identity-wallet flows will break.