What is the CVSS score of CVE-2026-12443?

CVE-2026-12443 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by CVE-2026-12443?

Google Chrome versions prior to 149.0.7827.155 allow attackers to gain unauthorized control of employee devices through malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-12443?

Within 24 hours, audit your organization's Chrome deployment to identify affected versions (those prior to 149.0.7827.155) and notify administrators and end users of patch availability. Within 7 days, deploy Chrome version 149.0.7827.155 or later to all managed endpoints through your endpoint management system, prioritizing users with administrative privileges and those handling sensitive information. Within 30 days, verify patch compliance across all Chrome installations using automated inventory reports and confirm that unmanaged or personal devices have been updated by conducting user attestation; retain remediation evidence for audit records.

Google Chrome CVE-2026-12443

EUVD-2026-37528 HIGH

Use After Free (CWE-416)

2026-06-17 Chrome

Denial Of Service RCE Use After Free Google Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with no auth but required user interaction (UI:R); renderer-scope UAF gives high C/I/A within an unchanged scope, matching the published vector.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:30 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Web Authentication in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

Articles & Coverage 2

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Remote code execution in Google Chrome (desktop) versions prior to 149.0.7827.155 stems from a use-after-free in the Web Authentication (WebAuthn) component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code. Chromium rates the flaw Critical severity; it carries CVSS 8.8 and requires user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and EPSS remains low at 0.44%, but the SSVC 'total' technical impact and the memory-corruption class make it a high-priority browser patch.

Technical ContextAI

The vulnerability lives in Chrome's Web Authentication (WebAuthn) implementation, the browser subsystem that handles the W3C WebAuthn / FIDO2 API for passwordless and hardware-security-key authentication. The root cause is CWE-416 (Use After Free): a heap object tied to WebAuthn processing is freed while a dangling reference is still used, allowing an attacker to reclaim and control the freed memory. In a renderer process this typically yields attacker-controlled pointers that, when chained, lead to arbitrary code execution within Chrome's sandboxed renderer. The single CPE provided, cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, indicates the desktop Chrome application across affected builds rather than a specific channel or platform.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.155 or later, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. Because Chrome auto-updates, confirm the update by navigating to chrome://settings/help and relaunching so the patched binary loads; in managed fleets, verify the deployed version through your update/MDM tooling and force the rollout. Users of Chromium-based redistributions (Red Hat, SUSE, and other downstreams noted in the tags) should apply the corresponding vendor package updates once published. If patching must be briefly delayed, the practical compensating control is to reduce exposure to untrusted web content - restrict browsing to trusted sites and consider disabling or limiting WebAuthn-driven flows where feasible - though disabling WebAuthn breaks passwordless/security-key logins and is not a substitute for updating; there is no field-level configuration flag that cleanly neutralizes this UAF without impacting legitimate functionality.