What is the CVSS score of CVE-2026-12465?

CVE-2026-12465 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-12465?

Google Chrome desktop versions below 149.0.7827.155 contain a sandbox escape vulnerability (CVSS 8.3) that allows attackers who achieve initial renderer process compromise to escalate to complete…. A patch is available.

How to fix or mitigate CVE-2026-12465?

Within 24 hours, inventory Chrome desktop versions across your organization and identify systems running versions prior to 149.0.7827.155. Within 7 days, deploy Chrome 149.0.7827.155 or later to all affected systems through your standard patch management process, prioritizing endpoints that access sensitive data or face elevated code execution risk. Within 30 days, verify full deployment compliance and confirm all Chrome desktop installations have been updated via automated asset scanning.

Google Chrome CVE-2026-12465

EUVD-2026-37550 HIGH

Improper Input Validation (CWE-20)

2026-06-17 Chrome

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H and UI:R reflect the crafted page plus a required pre-compromised renderer; PR:N follows Chrome convention treating renderer compromise as precondition; S:C and C/I/A:H capture the total-impact sandbox escape.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:35 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.3

DescriptionCVE.org

Object lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 2

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Sandbox escape in Google Chrome desktop prior to 149.0.7827.155 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, exploiting an object-lifecycle flaw in the Metrics component. It is a second-stage bug that turns renderer-level code execution into fuller compromise of the browser host, rated High by Chromium and scored CVSS 8.3. There is no public exploit identified at time of analysis, EPSS is low (0.30%, 21st percentile), and CISA/SSVC records no observed exploitation.

Technical ContextAI

The flaw lives in Chromium's Metrics subsystem, the telemetry/histogram machinery that collects usage and performance data across browser processes. NVD classifies the root cause as CWE-20 (Improper Input Validation), but the vendor description points more precisely to an object-lifecycle defect - a use-after-free or premature/dangling object reference (a classic memory-safety class) in how Metrics objects are managed. Because Metrics-related IPC and shared state cross the renderer/browser trust boundary, a renderer that manipulates this lifecycle can corrupt state in a higher-privileged process, which is the mechanism behind the Scope-changed (S:C) sandbox escape. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (all Chrome desktop builds before the fixed release); the same Chromium code is inherited by other Chromium-based browsers, though only Chrome is named here.

RemediationAI

Vendor-released patch: 149.0.7827.155 - update Google Chrome to 149.0.7827.155 or later via the Stable channel and restart the browser to apply it (see https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html and VulDB entry https://vuldb.com/vuln/371530). In managed environments, push the update through your endpoint/browser management policy and force a relaunch, since Chrome only completes patching on restart. Red Hat and SUSE users should update the distribution's Chromium/Chrome package once rebased to the fixed build. No standalone workaround neutralizes the bug itself; because exploitation requires a pre-compromised renderer, meaningful compensating controls target that first stage - keep the site-isolation feature enabled (default), restrict high-risk browsing, and deploy quickly against renderer RCE bugs so this escape cannot be chained. Disabling telemetry/metrics is not a validated mitigation and should not be relied upon.