What is the CVSS score of CVE-2026-12450?

CVE-2026-12450 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-12450?

Yes, a patch is available for CVE-2026-12450. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-12450

EUVD-2026-37535 MEDIUM

Improper Privilege Management (CWE-269)

2026-06-17 Chrome

Google Privilege Escalation

Medium

Disputed · 6.5 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page (AV:N, AC:L, PR:N, UI:R); memory disclosure only, no write or crash capability (C:H, I:N, A:N), no sandbox escape (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:04 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Process memory disclosure in Google Chrome's Media implementation exposes potentially sensitive data to remote attackers via a crafted HTML page. All Chrome versions prior to 149.0.7827.155 on desktop are affected; exploitation requires user interaction but no authentication. No public exploit code has been identified and CISA KEV lists no active exploitation, though the High confidentiality CVSS impact and broad deployment footprint make patching a priority.

Technical ContextAI

The vulnerability resides in Chrome's Media subsystem (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), which handles audio/video parsing and rendering within the browser process. The root cause is classified as CWE-269 (Improper Privilege Management), indicating that the Media component fails to properly restrict what memory regions it accesses or exposes during processing. An 'inappropriate implementation' in this context likely means the Media pipeline reads beyond intended buffers or improperly shares memory across isolation boundaries, leaking heap or stack contents from the Chrome renderer or browser process. This class of flaw is particularly impactful in browsers because process memory can contain session tokens, cached credentials, form data, or cryptographic material from prior page loads.

RemediationAI

The vendor-released patch is Google Chrome 149.0.7827.155; users should update immediately via Chrome's built-in updater or the stable channel release at chromereleases.googleblog.com. Enterprise administrators should push this version through managed deployment policies (Google Admin, Intune, or equivalent). Linux distributions carrying Chromium-based packages should be monitored for updated RPM/DEB packages from Red Hat and SUSE channels. If immediate update is not possible, a compensating control is to restrict access to untrusted external websites using URL filtering or browser isolation solutions - this limits attacker ability to deliver the crafted HTML page, though it does not eliminate the vulnerability. Disabling JavaScript or the media stack entirely would be too disruptive for most environments. No formal workaround has been identified by the vendor for this specific flaw.