What is the CVSS score of CVE-2026-12447?

CVE-2026-12447 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by CVE-2026-12447?

A remote code execution vulnerability in Google Chrome's WebRTC component (CVE-2026-12447) could allow attackers to execute arbitrary code within the browser sandbox by directing users to malicious…. A patch is available.

How to fix or mitigate CVE-2026-12447?

Within 24 hours, issue a security advisory to all Chrome users and IT staff, and assess your organization's Chrome deployment scope and version distribution. Within 7 days, deploy Chrome version 149.0.7827.155 or later across all endpoints using your enterprise software deployment mechanism, prioritizing user-facing systems and shared workstations. Within 30 days, verify patch deployment completion through your endpoint management tools and confirm that zero instances remain on unpatched versions.

Google Chrome CVE-2026-12447

EUVD-2026-37532 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-17 Chrome

RCE Buffer Overflow Google Heap Overflow

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with no auth but required user visit (UI:R); high C/I/A from arbitrary code execution, but S:U as impact stays within the renderer sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:05 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in WebRTC in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 2

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Heap-based buffer overflow in Google Chrome's WebRTC component (versions prior to 149.0.7827.155) lets a remote attacker execute arbitrary code inside the browser's renderer sandbox by luring a victim to a crafted HTML page. Google rates the Chromium severity as High and a fixed Stable channel build is available; there is no public exploit identified at time of analysis, and the EPSS score of 0.36% (28th percentile) reflects low near-term exploitation probability. CISA's SSVC framework records exploitation status as 'none,' so this is patch-worthy but not yet an emergency.

Technical ContextAI

WebRTC (Web Real-Time Communication) is the browser subsystem that powers peer-to-peer audio, video, and data channels used by video-conferencing and streaming web apps. It parses attacker-influenceable media/session data (SDP, RTP/RTCP, codec buffers) in the renderer process, which is a historically rich attack surface. The root cause is CWE-122 (Heap-based Buffer Overflow): code writes past the bounds of a heap-allocated buffer, corrupting adjacent heap memory. In a modern browser this typically requires chaining with an information leak and heap grooming to achieve reliable control-flow hijack, and any resulting code execution is confined to Chrome's renderer sandbox (S:U - no scope change) rather than the host OS. The affected product per CPE is cpe:2.3:a:google:chrome:*, i.e., the Chrome desktop browser across platforms; downstream rebuilds (Red Hat, SUSE per tags) inherit the flaw.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.155 - upgrade the browser to 149.0.7827.155 or later on all desktop platforms and restart Chrome so the update takes effect (verify via chrome://settings/help). Managed fleets should push the update through their enterprise management/update policy, and users of Chromium-based rebuilds should apply the equivalent Red Hat/SUSE package updates as they become available. No product-specific workaround is documented; if patching must be briefly deferred, compensating controls include ensuring Chrome's site isolation and sandbox remain enabled (do not launch with --no-sandbox), and, for high-risk endpoints, restricting or blocking access to untrusted sites and WebRTC-heavy content via web proxy/URL filtering - with the trade-off that WebRTC-based conferencing and streaming apps may break. Reference advisories: Google Stable Channel post (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html) and Chromium issue 513405023.