CVE-2026-12008: Chrome DigitalCredentials Use-After-Free Sandbox Escape Vulnerability

Technical summary

CVE-2026-12008 is a use-after-free memory corruption vulnerability (CWE-416) in the DigitalCredentials subsystem within Google Chrome. The vulnerability occurs when memory is accessed after it has been freed, creating a window for exploitation. An attacker with renderer process compromise can craft a malicious HTML page to trigger the use-after-free condition, potentially enabling a sandbox escape—a particularly severe outcome that would allow code execution with the privileges of the Chrome process on the host system. The flaw is rated CVSS 3.1 score 8.3 (HIGH), with a network attack vector, high attack complexity, and user interaction required.

Business impact

Successful exploitation of this vulnerability could allow attackers to move from a compromised browser process to full system compromise, undermining the fundamental security model that confines untrusted web content. This is particularly concerning for users who rely on Chrome's sandbox as a defense-in-depth layer against malicious websites. Organizations supporting users on affected systems face heightened risk of credential theft via the DigitalCredentials component and potential lateral movement into corporate networks. The attack complexity is high and requires user interaction, moderating some of the immediate threat landscape, but the consequence severity remains critical.

Affected systems

Google Chrome versions prior to 149.0.7827.115 are affected. The vulnerability can impact Chrome running on multiple operating systems: Windows, macOS, and Linux. While the CVE lists generic product categories (Microsoft Windows, Apple macOS, Linux kernel), the actual vulnerability is in Chrome itself; verify patch status against Chrome's official security advisories for the specific version running on each platform.

Exploitability

Exploitation requires two preconditions: (1) the attacker must first compromise the browser's renderer process, typically through another vulnerability, malicious script, or compromised website; (2) the victim must then visit a webpage controlled by the attacker or accept a crafted HTML file. Once the renderer is compromised, triggering the sandbox escape via a specially crafted page is the follow-on attack. The attack complexity rating reflects these multiple dependencies. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting limited evidence of active exploitation in the wild at time of publication, though this should not be interpreted as low risk given the critical nature of sandbox escape flaws.

Remediation

The primary remediation is updating Google Chrome to version 149.0.7827.115 or later. Users should enable automatic updates to ensure timely patching. Organizations managing Chrome deployments should verify update mechanisms are functioning and consider prioritizing this patch given the sandbox escape potential. As an interim measure, users can reduce exposure by limiting visits to untrusted websites and avoiding opening suspicious files in the browser, though these are not reliable substitutes for patching.

Patch guidance

Update Chrome to version 149.0.7827.115 or later. Check your current Chrome version by navigating to chrome://settings/help, which will automatically check for updates and display the installed version. Most users with auto-update enabled will receive this patch automatically; verify completion by confirming the version number matches or exceeds 149.0.7827.115. For enterprise deployments, consult Google's official Chrome security release notes and your organization's patch management policies.

Detection guidance

Monitor for successful exploitation by tracking process execution and privilege escalation events from Chrome processes to system processes or unexpected child processes launched from Chrome with elevated privileges. Behavioral indicators include Chrome spawning processes outside its normal sandbox profile, unusual file system or registry modifications originating from Chrome processes, or authentication logs showing credential usage following browser compromise. Detection is difficult if the initial renderer compromise remains undetected; focus on post-compromise indicators and maintain EDR tooling configured to flag sandbox escape patterns. Network-level detection is limited since the attack surfaces after the browser is already compromised.

Why prioritize this

Although this vulnerability carries a HIGH CVSS score and critical chromium severity, its practical exploitability is constrained by the prerequisite renderer compromise and the requirement for user interaction. However, organizations should not delay patching due to these factors: sandbox escapes are among the most valuable vulnerabilities in the threat landscape, and any improvement in attacker capability poses compounding risk. Prioritize patching environments where users browse untrusted content, visit high-risk sites, or may receive phishing attempts, and ensure automatic updates are enabled wherever possible. This is not a 'critical patch immediately' situation like network-facing RCE flaws, but it merits expedited deployment within normal patch cycles.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects high confidentiality, integrity, and availability impact (an attacker with renderer access could exfiltrate credentials, modify local files, or crash the system), combined with network-based attack delivery and high attack complexity (the need for prior renderer compromise). The user interaction requirement and the necessity of a compromised renderer moderates the score from 'Critical' to 'High.' However, the Chromium severity designation as 'Critical' emphasizes the qualitative severity of a sandbox escape, which is disproportionately dangerous even when other attack prerequisites exist. The practical risk depends on your user population's web browsing habits and the prevalence of other renderer compromises in your threat model.

Frequently asked questions