CVE-2026-12007: Critical Use-After-Free in Google Chrome on Windows

Technical summary

CVE-2026-12007 is a use-after-free vulnerability (CWE-416) in Google Chrome's Core component on Windows platforms. The vulnerability arises from improper memory lifecycle management in the browser engine. When processing specially crafted HTML, Chrome may deallocate memory objects but later attempt to reference them, allowing heap memory corruption. An attacker can craft a malicious HTML page that, when loaded in an unpatched Chrome instance, triggers this use-after-free condition and achieves arbitrary code execution in the browser's security context. The Chromium project assigned this a Critical severity rating.

Business impact

For enterprises, this vulnerability poses significant risk to Windows-based users browsing the web. Successful exploitation could result in malware installation, credential theft, lateral network movement, or data exfiltration—all executed with the privileges of the Chrome process. Organizations with Windows endpoints and Chrome deployments face elevated risk of compromise, particularly if threat actors distribute exploit-hosting pages through compromised sites, watering-hole attacks, or phishing campaigns. Patch deployment becomes a critical operational priority.

Affected systems

Google Chrome on Windows is the primary affected platform. Vulnerable versions are those prior to 149.0.7827.115. While the CVE record specifically mentions Windows, Chrome runs on multiple operating systems; organizations should verify whether their macOS and Linux Chrome deployments are affected by consulting the official Chrome security release notes and confirm patch applicability across their entire fleet. Microsoft Windows itself is listed as a vendor/product, likely indicating Windows version dependencies for exploitation context.

Exploitability

Exploitability is straightforward and does not require authentication or elevated privilege. An attacker only needs to craft a malicious HTML page and trick a user into visiting it—whether through phishing, watering-hole attacks, or compromised websites. The attack vector is network-based with low complexity, and user interaction (clicking a link or browsing to a page) is the only barrier. The use-after-free class of vulnerability is well-understood in the security community, making development of working exploits feasible for skilled attackers. However, the vulnerability is not currently known to be exploited in the wild according to available threat intelligence (KEV status is not active), though this should not delay patching.

Remediation

Update Google Chrome to version 149.0.7827.115 or later on all Windows systems. Organizations should prioritize this patch as part of immediate patching cycles rather than waiting for routine update schedules. Use configuration management tools or Mobile Device Management (MDM) solutions to enforce Chrome updates across the enterprise. For environments where immediate updates are not feasible, consider restricting Chrome usage temporarily or deploying web content filtering to block high-risk external sites until patches are deployed.

Patch guidance

Verify and apply Chrome version 149.0.7827.115 or later on all Windows endpoints. Chrome typically auto-updates but enterprises should confirm update completion through their device management dashboards. Check the official Chrome release notes at https://chromereleases.googleblog.com to confirm patch deployment timing. For managed deployments, use Chrome Enterprise policies to mandate updates. Coordinate with development and QA teams if they rely on older Chrome versions for testing—update test environments in parallel with production. Rollback is not recommended; users should move forward to patched versions only.

Detection guidance

Monitor Chrome version numbers via endpoint management tools or asset discovery systems to identify unpatched instances. Implement application control policies to prevent execution of Chrome versions below the patched threshold. On the detection side, monitor for unusual Chrome process behavior post-exploitation: unexpected child processes, memory corruption signals, or suspicious system calls. Network-level detection is challenging because the exploit delivery is a benign HTML page; focus on post-exploitation indicators such as lateral movement attempts or data exfiltration from compromised user sessions. Endpoint Detection and Response (EDR) solutions should flag Chrome crashes or abnormal memory access patterns as potential exploitation attempts.

Why prioritize this

This vulnerability merits immediate, high-priority patching despite not yet appearing on the CISA KEV catalog. The combination of critical Chromium severity rating, network-based attack vector, low user barrier, and ease of exploitation makes it attractive to threat actors. The use-after-free class is well-researched and reliably exploitable. Windows-based Chrome users represent a large attack surface for many organizations. Delay increases risk of compromise significantly.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH severity) reflects the vulnerability's profile: network attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), but requiring user interaction (UI:R). The impact metrics are maximum—confidentiality, integrity, and availability are all rated high (C:H/I:H/A:H)—because arbitrary code execution allows attackers to read sensitive data, modify system behavior, and disrupt availability. The score correctly captures the severity; the only mitigating factor is the requirement for user interaction, which prevents fully autonomous propagation but remains a minor obstacle in practice.

Frequently asked questions