What is the CVSS score of CVE-2026-12455?

CVE-2026-12455 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-12455?

A high-severity memory corruption vulnerability in Google Chrome could allow remote attackers to execute unauthorized code when users visit malicious websites and perform specific browser gestures.. A patch is available.

How to fix or mitigate CVE-2026-12455?

Within 24 hours, inventory Chrome deployments across the organization and communicate patch availability to users and IT teams. Within 7 days, prioritize deployment of Chrome version 149.0.7827.155 or later to all endpoints, emphasizing the HIGH severity rating. Complete the rollout to 100% of managed instances within 30 days, with accelerated timelines for high-risk user groups.

Google Chrome CVE-2026-12455

EUVD-2026-37540 HIGH

Use After Free (CWE-416)

2026-06-17 Chrome

Memory Corruption Use After Free Google Denial Of Service

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Remote crafted page (AV:N, PR:N) but requires specific user UI gestures (UI:R) and non-trivial memory grooming (AC:H); successful renderer compromise yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:02 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 2

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Use-after-free in the Tab Strip component of Google Chrome before 149.0.7827.155 allows a remote attacker to trigger heap corruption when a victim visits a crafted HTML page and performs specific UI gestures, potentially leading to code execution in the renderer. Google rated it High severity and a vendor patch is available, but no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.30% (21st percentile), and SSVC records exploitation status as none.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Tab Strip, the browser UI component that manages open tabs and their lifecycle. Use-after-free bugs occur when a pointer to freed heap memory is reused, letting an attacker reclaim the freed allocation with controlled data and corrupt the heap; in a browser renderer this is a classic primitive for achieving control-flow hijack, though modern Chrome sandboxing and mitigations (PartitionAlloc, MiraclePtr) raise exploitation difficulty. The affected product per CPE is cpe:2.3:a:google:chrome:*, i.e. the desktop Chrome browser; the same underlying Chromium fix propagates to downstream distributions, consistent with the Red Hat and SUSE tags. The reference issues.chromium.org/issues/517069848 tracks the upstream bug (access-restricted, as is typical for Chromium security issues).

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.155 or later via the Stable Channel; on managed fleets ensure auto-update is enabled and force a browser relaunch so the fix takes effect, and rebuild or update any embedded/Chromium-derived components. Downstream users on Red Hat or SUSE should apply the corresponding distribution browser updates once published. There is no documented feature-level workaround for this Tab Strip use-after-free; as an interim compensating control, reduce exposure by advising users not to interact with untrusted pages and, in high-security environments, deploy browsing isolation or restrict access to untrusted web content - noting this degrades usability and is not a substitute for the patch. Consult Google's advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html for release details.