What is the CVSS score of CVE-2026-12466?

CVE-2026-12466 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by CVE-2026-12466?

Google Chrome on Windows (versions prior to 149.0.7827.155) contains a remote code execution vulnerability (CVSS 8.8) that allows attackers to compromise browsers by tricking users into visiting…. A patch is available.

How to fix or mitigate CVE-2026-12466?

Within 24 hours, identify and prioritize Windows systems running Chrome versions prior to 149.0.7827.155 and prepare patch deployment procedures. Within 7 days, deploy Chrome version 149.0.7827.155 or later across all Windows endpoints using your standard patch management process, prioritizing business-critical users and systems. Within 30 days, verify successful deployment through EDR/endpoint management tools, validate that no systems remain on vulnerable versions, and monitor Chrome update logs to ensure automatic updates remain enabled.

Google Chrome CVE-2026-12466

EUVD-2026-37551 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-17 Chrome

RCE Buffer Overflow Google Heap Overflow Microsoft

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N, AC:L, PR:N) requiring the victim to visit it (UI:R); RCE in the sandboxed renderer yields high C/I/A within an unchanged scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:34 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 3

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 4 New Windows Vulnerabilities - 1 Critical, 3 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Remote code execution in Google Chrome on Windows (versions prior to 149.0.7827.155) allows a remote attacker to run arbitrary code within the browser process by luring a victim to a crafted HTML page that triggers a heap buffer overflow in the WebRTC component. Rated High severity by Chromium and scored CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis; EPSS is low at 0.40% and CISA SSVC records exploitation status as 'none'.

Technical ContextAI

The flaw resides in WebRTC (Web Real-Time Communication), the browser subsystem that enables peer-to-peer audio, video, and data channels directly from web pages without plugins. WebRTC parses and processes attacker-influenceable media and signaling data (SDP, RTP/RTCP packets, codec streams), making it a recurring source of memory-safety bugs. The root cause is CWE-122 (Heap-Based Buffer Overflow): data is written past the bounds of a heap-allocated buffer, corrupting adjacent heap memory. In a C++ codebase like Chromium's WebRTC, such corruption can be groomed to overwrite object pointers or function tables and redirect execution. The affected CPE is cpe:2.3:a:google:chrome, specifically the Windows desktop builds prior to 149.0.7827.155.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.155 or later on Windows via the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html); Chrome's built-in updater applies this automatically on relaunch, so verify the version under chrome://settings/help and force a browser restart across the fleet to ensure the new binary is loaded. If immediate patching is not possible, a targeted compensating control is to disable or restrict WebRTC - for example via enterprise policy to limit WebRTC usage or block WebRTC where not needed - which removes the vulnerable code path but breaks browser-based audio/video conferencing (Google Meet, Teams-in-browser, etc.); an alternative interim control is restricting browsing to trusted sites and enforcing web filtering to reduce exposure to attacker-controlled HTML pages. For Chromium derivatives (Edge, and Red Hat/SUSE-packaged browsers), apply the corresponding vendor updates as they become available.