What is the CVSS score of CVE-2026-12444?

CVE-2026-12444 has a contested CVSS base score of 5.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-12444?

Yes, a patch is available for CVE-2026-12444. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-12444

EUVD-2026-37529 MEDIUM

Out-of-bounds Read (CWE-125)

2026-06-17 Chrome

Microsoft Buffer Overflow Information Disclosure Google

Medium

Disputed · 5.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local vector with required user interaction for malicious file; out-of-bounds read yields high confidentiality loss but no write or availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:31 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

MEDIUM 5.5

DescriptionCVE.org

Out of bounds read in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: High)

AnalysisAI

Out-of-bounds read in Chromoting (Chrome Remote Desktop) on Windows exposes process memory to local attackers who can persuade a victim to open a malicious file. Affected are all Chrome releases on Windows prior to 149.0.7827.155. No public exploit code has been identified and EPSS places exploitation probability at the 8th percentile, indicating low near-term threat despite the High confidentiality impact rating assigned by the CVSS vector.

Technical ContextAI

The vulnerability resides in Chromoting, Google's Chrome Remote Desktop component embedded within the Chrome browser on Windows. CWE-125 (Out-of-Bounds Read) describes the root cause class: the parser or handler for a crafted input file reads memory beyond the allocated buffer boundary, allowing an attacker to observe bytes from adjacent process memory regions. Because the read does not cause a write or control-flow hijack, impact is limited to information disclosure rather than code execution. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions; the vendor advisory narrows the scope to the Windows platform and versions preceding 149.0.7827.155.

RemediationAI

Upgrade Google Chrome on Windows to version 149.0.7827.155 or later, which is the vendor-released patch confirmed via the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. Chrome's auto-update mechanism should deliver this automatically to most managed and consumer installations; administrators should verify fleet-wide deployment via endpoint management tooling. If immediate patching is not feasible, a practical compensating control is to disable or uninstall the Chrome Remote Desktop (Chromoting) host component from affected Windows systems, which removes the vulnerable attack surface with the trade-off of losing remote desktop functionality. Restricting which users can open untrusted files on systems running Chromoting also reduces exposure, as user interaction is required to trigger the vulnerability.