CVE-2026-12012: Chrome Use-After-Free Network Vulnerability (CVSS 8.1)

Technical summary

CVE-2026-12012 is a use-after-free vulnerability (CWE-416) in Chrome's network stack. The flaw occurs when the browser incorrectly handles memory deallocation during network processing, allowing an attacker on the network path to send specially crafted traffic that causes the freed memory to be accessed. This can lead to heap corruption, potentially enabling arbitrary code execution within Chrome's context. The vulnerability requires an attacker in a privileged network position—such as on the same local network, a compromised router, or an intercepted connection—but does not require user action to exploit.

Business impact

Organizations with Chrome as a standard browser face risk of endpoint compromise through network-based attacks. Threat actors could leverage this to establish persistence, steal data, or move laterally within networks. The privilege requirement (network position) reduces but does not eliminate real-world risk, particularly for organizations on shared or untrusted networks, in public WiFi scenarios, or where network perimeter security is weak. The High severity rating and heap corruption potential warrant prioritization for enterprise environments.

Affected systems

Google Chrome versions prior to 149.0.7827.115 are directly affected. The vulnerability also impacts Chrome on macOS, Linux, and Windows systems. Organizations should verify their Chrome installation version and update immediately if running any build earlier than 149.0.7827.115.

Exploitability

The vulnerability requires an attacker to occupy a network vantage point to intercept or inject traffic, which limits opportunistic exploitation compared to user-clickable attacks. However, this is achievable in multiple real-world scenarios: local network presence (corporate network, shared WiFi), compromised network infrastructure, or man-in-the-middle positioning. Once the attacker crafts and sends malicious network traffic, no user interaction is needed. The technical barrier to exploitation is moderate; proof-of-concept development would require knowledge of Chrome's network protocol handling and memory layout, but a sophisticated threat actor would find this feasible. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog, but organizations should assume active research is underway.

Remediation

Update Google Chrome to version 149.0.7827.115 or later immediately. Users can verify their version at chrome://version and auto-update by restarting the browser if auto-update is enabled. Organizations should enforce Chrome updates via group policy (Windows), configuration management (macOS/Linux), or mobile device management for Chrome on mobile devices. Older Chromium-based browsers (Edge, Brave, Opera) may have a separate release schedule—verify updates from each vendor.

Patch guidance

Google has released Chrome 149.0.7827.115 or later to fix this issue. Verify the version number in your deployment against the official Chrome release notes. Users on Windows, macOS, and Linux should all update. Chrome will attempt auto-update, but organizations can force updates through policy tools. For managed environments, test the update in a non-production environment first to ensure no compatibility issues with internal web applications. Verify update success by checking the version in Settings > About Google Chrome on multiple endpoints.

Detection guidance

Detect exploitation by monitoring for unusual network behavior toward Chrome processes: sudden increases in network errors, malformed network packets, or unexpected crashes of the Chrome process. Monitor endpoint security tools for memory corruption events or heap-based attack signatures. In network-monitored environments, look for patterns consistent with MITM attacks (DNS spoofing, ARP spoofing, SSL stripping). Correlate Chrome crashes with network anomalies. After patching, verify no unpatched Chrome instances remain using vulnerability scanning or EDR tools. Organizations without active network monitoring should prioritize patching over detection.

Why prioritize this

This is a HIGH severity, network-exploitable memory corruption vulnerability with no user interaction required. While it requires privileged network position, this is achievable in common scenarios. The lack of KEV listing suggests limited public exploitation so far, but organizations should treat this as high-priority due to the severity and the potential for memory-based attacks to be weaponized. Prioritize patching over all non-critical Chrome versions in your environment within 48-72 hours.

Risk score, explained

The CVSS 3.1 score of 8.1 (High) reflects high impact (confidentiality, integrity, and availability all compromised via heap corruption), network accessibility, no user interaction required, and unchanged scope. The score is tempered by the requirement for an attacker to be in a privileged network position (high complexity), which reduces the attack surface compared to remote unauthenticated exploits. For typical enterprise environments, adjust the risk upward if your organization operates on shared or untrusted networks; adjust downward if perimeter controls prevent network-level threats.

Frequently asked questions