CVE-2026-12011: Chrome WebMIDI Use-After-Free Sandbox Escape (Windows)

Technical summary

CVE-2026-12011 is a use-after-free vulnerability (CWE-416) in the WebMIDI subsystem of Google Chrome running on Windows versions prior to 149.0.7827.115. The flaw exists in memory management within the WebMIDI implementation, where freed memory may be accessed after deallocation. An attacker with an existing compromise of the Chrome renderer process can craft a malicious HTML page to trigger this condition, potentially escaping Chrome's sandbox isolation and executing arbitrary code with user privileges on the underlying Windows system.

Business impact

This vulnerability poses a critical risk in environments where users regularly visit untrusted or compromised websites. If an attacker gains initial renderer-process access (through a separate vulnerability or social engineering), they can leverage this flaw to break out of Chrome's sandbox and access sensitive files, install malware, or pivot to other systems. The sandbox-escape capability elevates the threat from a browser compromise to a full system compromise, significantly expanding the attack surface.

Affected systems

Google Chrome on Windows systems running versions prior to 149.0.7827.115. The vulnerability does not affect Chrome on other platforms (macOS, Linux, ChromeOS, Android) based on the published description, though organizations should verify coverage with Google's official security advisory. Windows systems of all versions using the affected Chrome release are in scope.

Exploitability

Exploitation requires two conditions: first, the attacker must already control the Chrome renderer process (via a separate vulnerability, drive-by download, or malware), and second, the user must visit a crafted webpage while using a vulnerable Chrome version. The CVSS score of 8.3 (HIGH) reflects the high impact (confidentiality, integrity, and availability all compromised) but moderate attack complexity and the prerequisite of user interaction. Active exploitation is not currently tracked in CISA's Known Exploited Vulnerabilities catalog, but the critical Chromium severity rating and sandbox-escape nature make this a priority for patching.

Remediation

Update Chrome immediately to version 149.0.7827.115 or later. Google released this patch to address the underlying use-after-free condition. For organizations managing Chrome through mobile device management (MDM) or Group Policy, deploy the patched version to all Windows endpoints. Verify that auto-update is enabled in Chrome settings; users can also manually check for updates via the menu (hamburger icon) → Help → About Google Chrome.

Patch guidance

Chrome version 149.0.7827.115 or later eliminates this vulnerability. Organizations should prioritize deployment of the patch to all Windows systems, particularly for users who browse untrusted or high-risk websites. Chrome's auto-update mechanism should deliver the patch automatically if enabled; however, confirm completion by checking the version number in Chrome's settings (chrome://settings/help). For enterprise environments, verify patch deployment via your MDM console or Group Policy reporting tools. No workarounds are available; patching is mandatory.

Detection guidance

Monitor Chrome process behavior for suspicious memory access patterns or sandbox escapes using endpoint detection and response (EDR) tools configured to flag process privilege elevation or unexpected system calls from the Chrome rendering process (chrome.exe with low privileges attempting to access kernel-level resources). Log Chrome version information across your environment to identify unpatched instances; tools like Lansweeper or similar asset inventory systems can report version numbers. Network-based detection of WebMIDI-specific exploitation is difficult, but alerts on unusual browser-spawned child processes or access to sensitive system resources should be tuned.

Why prioritize this

This vulnerability merits immediate patching despite not yet appearing in active-exploitation tracking. The combination of sandbox-escape capability, critical Chromium severity, and the prevalence of Chrome in enterprise and consumer environments makes it a priority. The two-stage attack requirement (prior renderer compromise) slightly lowers the immediate risk compared to a direct remote code execution, but organizations should assume targeted attackers may chain this with other vulnerabilities or social engineering to establish initial access.

Risk score, explained

The CVSS 8.3 (HIGH) score reflects: (1) Network attack vector—exploitation can be triggered remotely via a webpage; (2) High complexity—requires prior renderer compromise and user interaction; (3) No special privileges needed for the initial webpage delivery; (4) User interaction required (user must visit the malicious page); (5) Changed scope—the impact crosses from the browser sandbox to the underlying system; (6) High confidentiality, integrity, and availability impact once the sandbox is escaped. The severity is not rated CRITICAL at the CVSS level because the attack requires a prerequisite compromise, but Google's Chromium severity rating of Critical underscores the severity of a sandbox-escape vulnerability in a widely deployed browser.

Frequently asked questions