What is the CVSS score of CVE-2026-12441?

CVE-2026-12441 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-12441?

Google Chrome versions prior to 149.0.7827.155 on Linux contain a critical heap corruption vulnerability allowing remote code execution when users visit malicious web pages.. A patch is available.

How to fix or mitigate CVE-2026-12441?

Within 24 hours, issue an urgent patch notification to all Chrome users on Linux systems directing immediate upgrade to Chrome 149.0.7827.155 or later and initiate mandatory automated patch deployment if available in your environment. By day 7, verify completion of patching across all Linux-based Chrome deployments through your endpoint management console, prioritizing critical infrastructure and high-risk user groups. By day 30, audit 100% compliance with Chrome 149.0.7827.155 or later across all Linux assets and validate that automatic security updates are enabled organization-wide to prevent future exposure.

Google Chrome CVE-2026-12441

EUVD-2026-37526 HIGH

Use After Free (CWE-416)

2026-06-17 Chrome

Memory Corruption Use After Free Google Denial Of Service

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no auth (PR:N) but requires the victim to open it (UI:R); renderer-contained memory corruption yields high C/I/A with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:32 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in File Input in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

Articles & Coverage 2

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Heap corruption via use-after-free in Google Chrome's File Input component on Linux affects all versions prior to 149.0.7827.155, allowing a remote attacker to exploit memory corruption through a crafted HTML page that the victim visits. Chromium rates this Critical severity and a vendor patch is available; no public exploit has been identified at time of analysis and the SSVC framework records exploitation status as none. EPSS is low at 0.29% (21st percentile), consistent with a freshly patched, not-yet-weaponized browser flaw.

Technical ContextAI

The flaw is a CWE-416 use-after-free in the File Input handling path of Chrome (the CPE cpe:2.3:a:google:chrome covers the desktop browser). File Input refers to the browser's handling of <input type="file"> elements and their associated file selection/upload objects; a use-after-free arises when a heap object backing that control is freed but a dangling reference is subsequently dereferenced, typically by attacker-controlled JavaScript/DOM manipulation timing. Freed heap chunks can be reclaimed and groomed by an attacker, turning the dangling pointer into controllable heap corruption. Because Chrome renders untrusted web content in the renderer process, such memory-safety bugs are a well-understood primitive that, when chained with a sandbox escape, can lead to code execution; on its own the renderer bug still yields high-impact corruption within the renderer.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.155 or later on Linux, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html); Chrome's auto-update normally applies this after a browser restart, so ensure users fully relaunch the browser to load the fix. For managed Linux fleets using distribution packages, apply the corresponding Red Hat and SUSE Chromium updates as they publish downstream builds. As an interim compensating control before patching, restrict browsing to trusted sites or deploy enterprise policies that harden the renderer; note that generic web-content restrictions reduce usability and do not fully eliminate the risk, so patching remains the only complete fix. Additional detail is tracked at https://vuldb.com/vuln/371496 and https://issues.chromium.org/issues/520157118.