What is the CVSS score of CVE-2026-12448?

CVE-2026-12448 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-12448?

Google Chrome WebView on Android (pre-version 149.0.7827.155) contains a privilege escalation flaw enabling remote attackers to escape the application sandbox through malicious HTML content.. A patch is available.

How to fix or mitigate CVE-2026-12448?

Within 24 hours, identify all Android applications in your environment using Chrome WebView and coordinate with development and operations teams to prioritize patching. Within 7 days, deploy Chrome WebView version 149.0.7827.155 and later to all managed Android devices through your mobile device management platform and update all internally developed applications with the patched WebView component. Within 30 days, complete deployment verification through automated telemetry, update vulnerability records to reflect remediated status, and conduct follow-up security assessment to ensure the privilege escalation vector is closed.

Google Chrome CVE-2026-12448

EUVD-2026-37533 HIGH

Improper Privilege Management (CWE-269)

2026-06-17 Chrome

Google Privilege Escalation

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no privileges (PR:N) but requires the victim to load it (UI:R); privilege escalation yields total impact (C:H/I:H/A:H) within the same component (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:05 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 3

News 4 New Android Vulnerabilities - 4 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Privilege escalation in Google Chrome's WebView component on Android (versions prior to 149.0.7827.155) allows a remote attacker to break out of intended privilege boundaries when a victim opens a crafted HTML page. Rated High by Chromium with a CVSS of 8.8, the flaw yields high confidentiality, integrity, and availability impact but requires user interaction. No public exploit is identified at time of analysis, and the low EPSS (0.27%) plus SSVC 'Exploitation: none' indicate it is not currently being exploited despite the severe technical impact.

Technical ContextAI

The vulnerability lives in Android WebView as embedded/used by Google Chrome. WebView is the Chromium-based engine Android apps and the browser use to render web content, and it enforces origin- and permission-based privilege boundaries between web content and the host. The root cause is classified as CWE-269 (Improper Privilege Management): an 'inappropriate implementation' means the component grants or fails to constrain privileges correctly, letting untrusted web content operate with capabilities it should not have. The affected product per CPE is cpe:2.3:a:google:chrome:*, with the fix landing in Chrome 149.0.7827.155 on Android.

RemediationAI

Vendor-released patch: 149.0.7827.155 - update Google Chrome for Android to 149.0.7827.155 or later, which is the primary and sufficient fix. On most devices Chrome updates automatically via Google Play, so verify the installed version and force an update where auto-update is disabled or delayed. For managed Android fleets, push the updated Chrome/WebView package through MDM and confirm the WebView provider is current, since apps embedding WebView also depend on the updated component. Until updates are confirmed applied, reduce exposure by advising users to avoid untrusted links and restricting sideloaded browsing where feasible; there is no documented feature-level workaround, so patching is the effective control. Refer to the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html and VulDB entry https://vuldb.com/vuln/371495.