What is the CVSS score of CVE-2026-12454?

CVE-2026-12454 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-12454?

Google Chrome for macOS before 149.0.7827.155 contains a sandbox escape vulnerability (CVSS 8.3) that could allow a compromised browser process to gain system-level access.. A patch is available.

How to fix or mitigate CVE-2026-12454?

Within 24 hours, inventory Chrome on macOS deployments currently running versions below 149.0.7827.155, prioritizing systems used by developers and security staff. Within 7 days, deploy Google Chrome 149.0.7827.155 or later organization-wide and enable automatic updates to prevent regression. Complete patching and verification within 30 days, confirming through endpoint management tools that no vulnerable Chrome instances remain in production.

Google Chrome CVE-2026-12454

EUVD-2026-37539 HIGH

Race Condition (CWE-362)

2026-06-17 Chrome

Race Condition Information Disclosure Google

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Crafted page is network-delivered (AV:N) with user interaction (UI:R); winning a race is AC:H; escaping the renderer sandbox to the host is a scope change (S:C) with total impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:02 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.3

DescriptionCVE.org

Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 2

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Sandbox escape in Google Chrome on macOS before 149.0.7827.155 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a race condition (CWE-362) in the Safe Browsing component. Rated High by Chromium with CVSS 8.3, it is a second-stage exploit-chain primitive rather than a standalone entry point. There is no public exploit identified at time of analysis, CISA SSVC marks exploitation as none, and EPSS is low at 0.24% (15th percentile).

Technical ContextAI

The flaw is a concurrency defect (CWE-362, race condition / TOCTOU) inside Chrome's Safe Browsing subsystem, the reputation service that checks URLs and downloads against Google's malware and phishing lists. Because Safe Browsing logic straddles the sandboxed renderer and higher-privileged browser-process boundaries, a timing window between check and use can be manipulated by a controlled renderer to corrupt state or reach privileged code paths, enabling escape from the renderer sandbox. The affected component is Chrome's multi-process/sandbox architecture on macOS specifically; the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers the desktop application, and the fix landed in the 149.0.7827.x stable train.

RemediationAI

Vendor-released patch: 149.0.7827.155. Upgrade Google Chrome on macOS to 149.0.7827.155 or later via the built-in updater (Chrome menu, About Google Chrome) and relaunch to apply, then confirm no tabs remain on the pre-patch build; managed fleets should push the update through MDM/Google Admin console policy. Per the Chrome stable channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html; see also https://vuldb.com/vuln/371505), this is the primary fix. Because the flaw is a sandbox escape requiring a pre-compromised renderer, interim compensating controls target the chain's entry point rather than this bug directly: enforce Enhanced Safe Browsing and site isolation, restrict browsing to trusted sites via enterprise policy or a web proxy, and keep the renderer-side attack surface patched - trade-off is that these reduce but do not eliminate exposure and do not substitute for the version upgrade, which is the only complete remediation.