What is the CVSS score of CVE-2026-12440?

CVE-2026-12440 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-12440?

A critical vulnerability in Google Chrome for Windows (CVE-2026-12440) enables remote attackers to bypass Chrome's security sandbox and execute code by deceiving users into visiting malicious…. A patch is available.

How to fix or mitigate CVE-2026-12440?

Within 24 hours, inventory Chrome deployment across Windows endpoints and notify IT and users of patch requirements. Within 7 days, deploy Chrome version 149.0.7827.155 or later through your standard patch management process; prioritize managed endpoints and enforce updates via Group Policy or Mobile Device Management for BYOD devices. Within 30 days, verify patch compliance across all Windows Chrome installations, review endpoint detection and response (EDR) logs for suspicious activity during the vulnerability window, and audit browser history for evidence of malicious website visits.

Google Chrome CVE-2026-12440

EUVD-2026-37525 CRITICAL

Use After Free (CWE-416)

2026-06-17 Chrome

Denial Of Service Use After Free Google Microsoft Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs no privileges but requires the victim to visit (UI:R); the UAF enables a sandbox escape, so scope changes (S:C) with high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:32 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Articles & Coverage 4

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 4 New Windows Vulnerabilities - 1 Critical, 3 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026 News Critical Remote Code Execution in Windows - CVE-2026-12440 Jun 17, 2026

AnalysisAI

Sandbox escape in Google Chrome on Windows before 149.0.7827.155 stems from a use-after-free in the DigitalCredentials component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and potentially break out of the renderer sandbox. Rated Critical by Chromium with a CVSS of 9.6 and a scope-changing vector, though there is no public exploit identified at time of analysis and EPSS remains low at 0.31%. Exploitation requires user interaction (visiting a malicious page) but no privileges or authentication.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's DigitalCredentials subsystem, the browser-side implementation of the W3C Digital Credentials API used to request and present verifiable identity credentials (e.g., mobile driver's licenses, digital IDs) to web origins. Use-after-free bugs occur when a pointer to freed heap memory is dereferenced or reallocated, giving an attacker control over object contents and, with reliable heap grooming, a primitive to hijack control flow. Because DigitalCredentials brokers messages between the renderer and more-privileged browser process, a memory-corruption bug there is a classic path to sandbox escape rather than a simple renderer crash. Per the CPE (cpe:2.3:a:google:chrome:*), all Chrome builds on Windows prior to the fixed release are in scope; Chromium-derived downstreams (Edge, Brave, etc.) built on the same milestone are likely affected but are not enumerated in this data.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.155 or later on Windows via the Stable channel (Settings > About Chrome triggers the auto-update and requires a browser restart to take effect); see https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. In managed environments, push the update through your software distribution or Chrome enterprise policy and confirm the restart completes, since the fix is inert until relaunch. If patching must be delayed, a targeted compensating control is to disable the Digital Credentials API surface via enterprise policy or feature flags to remove the vulnerable code path, accepting that sites relying on digital-identity presentation will break; broader hardening such as restricting untrusted browsing and enabling site isolation reduces but does not eliminate exposure. Chromium-based downstreams (Edge, Brave, and Red Hat/SUSE packages) should be updated to the build that incorporates the corresponding Chromium fix.