What is the CVSS score of CVE-2026-12468?

CVE-2026-12468 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-12468?

Google Chrome on macOS before version 149.0.7827.155 is vulnerable to a sandbox escape (CVE-2026-12468, CVSS 8.3) that could allow attackers with a pre-existing renderer process compromise to…. A patch is available.

How to fix or mitigate CVE-2026-12468?

Within 24 hours, alert all macOS users of the vulnerability and affected Chrome versions (pre-149.0.7827.155), requesting immediate updates; audit your Chrome deployment to identify affected systems. Within 7 days, deploy Chrome version 149.0.7827.155 or later across your macOS fleet using your endpoint management system or by enabling automatic updates. Within 30 days, verify 100% compliance and close out the vulnerability in your change and compliance tracking systems.

Google Chrome CVE-2026-12468

EUVD-2026-37518 HIGH

Race Condition (CWE-362)

2026-06-17 Chrome

Race Condition Information Disclosure Google

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Renderer must be pre-compromised so PR:L not PR:N; winning the race is hard (AC:H) and a page load is needed (UI:R); sandbox escape gives S:C with full impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:34 vuln.today

CVE Published

Jun 17, 2026 - 01:38 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 01:38 cve.org

HIGH 8.3

DescriptionCVE.org

Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 2

News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 18, 2026 News 20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity Jun 17, 2026

AnalysisAI

Sandbox escape in Google Chrome on macOS before 149.0.7827.155 lets an attacker who has already compromised the renderer process abuse a race condition (CWE-362) in the Updater component to break out of the sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 8.3 and scope-changing impact, but exploitation requires a pre-existing renderer compromise plus user interaction, making it a second-stage bug rather than a single-shot RCE. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC lists exploitation as none.

Technical ContextAI

The flaw lives in Chrome's Updater on macOS, the privileged component responsible for keeping the browser up to date, which runs outside the renderer sandbox. CWE-362 (concurrent execution using shared resource without proper synchronization / race condition) is the root-cause class: two operations touching shared Updater state can interleave unexpectedly, letting a controlled renderer manipulate the sequence to influence a higher-privileged operation. Because the renderer sandbox is the primary security boundary in Chrome's multi-process architecture, a race that lets renderer-controlled input reach the Updater collapses the trust boundary between the sandboxed content process and the more privileged update path. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome application itself, and the issue is macOS-specific per the advisory.

RemediationAI

Update Google Chrome to 149.0.7827.155 or later on macOS - Vendor-released patch: 149.0.7827.155 (Chrome Stable channel), per https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. Because this is a client-side browser flaw, ensure Chrome's automatic update mechanism is enabled and force-restart the browser so the update applies, or push the fixed build via enterprise management (Google Update / MDM); verify the running version under chrome://settings/help. There is no configuration toggle for the Updater race itself, so no reliable in-product workaround exists short of patching; compensating controls to reduce the practical risk of the prerequisite renderer compromise include enforcing site isolation (default on), restricting untrusted browsing, and deploying the fixed build to all endpoints promptly, accepting that these reduce but do not eliminate exposure. Red Hat and SUSE users should apply their distribution's corresponding Chrome/Chromium package update.