What is the CVSS score of CVE-2026-12452?

CVE-2026-12452 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-12452?

Google Chrome for Android versions before 149.0.7827.155 contain a heap corruption vulnerability allowing remote code execution when users visit a crafted webpage.. A patch is available.

How to fix or mitigate CVE-2026-12452?

Within 24 hours: Issue security alert to all Android users and mobile device administrators mandating immediate update to Chrome 149.0.7827.155 or later; enable auto-update notifications. Within 7 days: Deploy patch via mobile device management (MDM) to all managed Android devices; verify deployment metrics across fleet. Within 30 days: Confirm Chrome version compliance on all organizational and BYOD endpoints; document remediation completion for compliance records.

Google Chrome CVE-2026-12452

EUVD-2026-37537 HIGH

Use After Free (CWE-416)

2026-06-17 Chrome

Memory Corruption Use After Free Google Denial Of Service

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with low complexity and no auth, but victim must open the page (UI:R); use-after-free yields high C/I/A within the renderer, scope unchanged absent a sandbox escape.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:03 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Downloads in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 3

News 4 New Android Vulnerabilities - 4 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Heap corruption in the Downloads component of Google Chrome for Android before 149.0.7827.155 lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially achieving code execution in the renderer. Rated High severity by Chromium with an 8.8 CVSS, but there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.30%, 21st percentile), consistent with a patched browser bug not yet weaponized.

Technical ContextAI

The flaw is a CWE-416 Use After Free in Chrome's Downloads subsystem, the browser component that manages download requests, item lifecycle, and file handling. A use-after-free occurs when a heap object is freed but a dangling pointer to it is later dereferenced; an attacker who controls heap layout (e.g. via crafted HTML/JavaScript driving download operations) can groom freed memory to force reuse of a controlled object, corrupting the heap and steering execution. The affected code runs inside Chrome's renderer/browser process on Android; CPE cpe:2.3:a:google:chrome identifies the Chrome application as the affected product, specifically the Android build per the description.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.155 or later on Android via the Google Play Store, and ensure Chrome auto-updates are enabled so future Stable-channel fixes apply automatically; reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html and the Chromium tracker at https://issues.chromium.org/issues/515462244. Because exploitation requires the user to load a crafted HTML page, interim compensating controls include avoiding untrusted links and, in managed fleets, using enterprise policy to enforce the minimum Chrome version and restrict browsing to trusted sites; note these controls reduce but do not eliminate exposure and can disrupt legitimate downloads. Users on Chromium-based builds should apply corresponding Red Hat/SUSE updates as they become available.