What is the CVSS score of CVE-2026-12445?

CVE-2026-12445 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-12445?

Google Chrome versions prior to 149.0.7827.155 contain a code-execution vulnerability in the Extensions component that attackers can exploit through malicious extensions.. A patch is available.

How to fix or mitigate CVE-2026-12445?

Within 24 hours, verify Chrome auto-update policies are enabled and identify all Chrome deployments in your environment. Within 7 days, enforce Chrome 149.0.7827.155 or later across all systems through your standard patch management process, prioritizing high-risk endpoints and those accessing sensitive data. Within 30 days, strengthen extension policies by implementing extension allowlisting and disabling user installation of unknown extensions.

Google Chrome CVE-2026-12445

EUVD-2026-37530 HIGH

Use After Free (CWE-416)

2026-06-17 Chrome

Memory Corruption Use After Free Google Denial Of Service

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered extension but requires victim to install it (UI:R) and non-trivial heap grooming (AC:H); no prior privileges (PR:N) and full memory-corruption impact yields C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:30 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

Articles & Coverage 2

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Heap corruption in Google Chrome's Extensions component (versions prior to 149.0.7827.155) allows an attacker who convinces a victim to install a malicious extension to trigger a use-after-free and potentially achieve arbitrary code execution within the renderer or browser process. Rated High by Chromium and scored CVSS 7.5, the flaw was reported internally by the Chrome team and is patched in the stable channel; no public exploit identified at time of analysis and EPSS is low at 0.19%.

Technical ContextAI

The vulnerability is a CWE-416 use-after-free in Chrome's extension subsystem, which manages the lifecycle of extension processes, background pages, and the extension APIs bridging untrusted extension code to privileged browser functionality. A use-after-free occurs when memory is freed but a dangling pointer is subsequently dereferenced; in a browser context a crafted extension can manipulate object lifetimes so that freed heap memory is reallocated and reused under attacker control, enabling heap corruption and potential control-flow hijack. The affected component is identified in CPE data as cpe:2.3:a:google:chrome (all versions below the fixed build), and downstream Chromium consumers are implicated by the Red Hat and SUSE tags, since these distributions ship Chromium-based packages that inherit the same defect.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.155 or later via the Stable Channel and restart the browser to apply it; most installations auto-update, so verify the running version under chrome://settings/help. Users of Chromium repackaged by Red Hat or SUSE should apply their distribution's corresponding updated package once it rebases to the fixed Chromium build. As a compensating control until patched, restrict extension installation to an allowlist via enterprise policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist set to '*'), which prevents installation of the untrusted extensions this bug requires - the trade-off is that legitimate self-service extension installs are blocked and must be centrally managed. Primary advisory: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html.