What is the CVSS score of CVE-2026-12467?

CVE-2026-12467 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-12467?

Google Chrome's Extensions sandbox component (versions prior to 149.0.7827.155) contains a use-after-free vulnerability enabling privilege escalation if the renderer process has already been…. A patch is available.

How to fix or mitigate CVE-2026-12467?

Within 24 hours, inventory organizational Chrome versions and identify systems running pre-149.0.7827.155 on desktop; verify patch availability through your browser deployment channel. Within 7 days, deploy Chrome 149.0.7827.155 or later across all desktop endpoints through automated updates or manual distribution, prioritizing high-risk user roles; verify installation on at least 90% of systems. Within 30 days, achieve 100% deployment completion and cross-reference with vulnerability scanning to confirm all vulnerable instances have been remediated.

Google Chrome CVE-2026-12467

EUVD-2026-37517 HIGH

Use After Free (CWE-416)

2026-06-17 Chrome

Memory Corruption Use After Free Google Denial Of Service

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires a pre-existing renderer compromise (modeled as PR:L) and user interaction; AC:H for unreliable UAF; scope change C as sandbox escape crosses to the browser process with total impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:34 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 2

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Sandbox escape in Google Chrome's Extensions component (versions prior to 149.0.7827.155 on desktop) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page exploiting a use-after-free (CWE-416). Rated High by Chromium and CVSS 8.3, it is a second-stage bug requiring a prior renderer compromise plus user interaction. There is no public exploit identified at time of analysis, EPSS is low (0.27%), and SSVC records exploitation status as none.

Technical ContextAI

The flaw is a use-after-free (CWE-416) in Chromium's Extensions subsystem, the privileged browser-process machinery that manages extension lifecycles, messaging, and APIs. A use-after-free occurs when memory is freed but a dangling pointer is subsequently dereferenced, letting an attacker who controls heap layout reclaim the freed object and hijack execution flow. Because Extensions logic runs at a higher privilege than the sandboxed renderer, a memory-corruption primitive there is a classic vector for crossing the renderer/browser trust boundary - hence the scope-change (S:C) in the CVSS vector. The single CPE provided, cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, identifies Google Chrome desktop as the affected product; Chromium-derived downstreams (the Red Hat and SUSE tags reflect distribution rebuilds) inherit the same code and require the corresponding upstream fix.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.155 or later on the Stable desktop channel, then fully restart the browser to load the new binary (Chrome auto-updates but the fix does not take effect until relaunch); verify via chrome://settings/help. Organizations running Chromium-based browsers or Linux distribution builds should apply the corresponding vendor package updates from Red Hat and SUSE once published. If patching must be deferred, the practical compensating control is to reduce the pre-conditions this bug requires: disable or tightly restrict browser extensions via enterprise policy (ExtensionInstallBlocklist / ExtensionInstallAllowlist) to shrink the Extensions attack surface, and enforce site isolation and the sandbox - but note that restricting extensions can break business-critical workflows that depend on them. Advisory: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html.