CVE-2026-12015: Use-After-Free in Chrome Autofill Information Disclosure

Technical summary

CVE-2026-12015 is a use-after-free vulnerability (CWE-416) in the autofill component of Google Chrome versions prior to 149.0.7827.115. The flaw allows a threat actor with control over the renderer process to craft a malicious HTML page that triggers unsafe memory access, enabling the reading of sensitive data from the browser's process memory. The vulnerability requires the attacker to have already compromised the renderer process separately, and requires user interaction to visit the malicious page. Chromium classified this as High severity from a browser security perspective, though the CVSS 3.1 score of 5.3 reflects the prerequisite of renderer compromise.

Business impact

Data exposure is the primary business risk. If a user's browser renderer has been compromised, this vulnerability allows attackers to exfiltrate sensitive information that may include autofill data (payment details, personal identifiers, credentials), session tokens, or other confidential information resident in process memory. For organizations where employees use Chrome with synchronized credentials or payment methods, successful exploitation could result in credential theft or financial fraud. Reputational and regulatory impacts depend on what data is exposed and whether affected users are customers or employees.

Affected systems

Google Chrome versions prior to 149.0.7827.115 are vulnerable. The vulnerability affects Chrome on all major platforms: Apple macOS, Linux (including the Linux kernel when Chrome is deployed), and Microsoft Windows. Organizations should audit Chrome deployment across all operating systems to identify instances below the patched version.

Exploitability

Exploitability is constrained by two prerequisites: the attacker must first compromise the renderer process through a separate vulnerability or supply chain attack, and the user must visit a malicious webpage. While the CVSS vector reflects 'high complexity' due to these requirements, the attack is not publicly known to be exploited in the wild at this time (KEV status is not tracked). However, the low barrier to weaponization once renderer access exists means this should not be underestimated in high-risk environments where browser exploits are part of threat models.

Remediation

Users and administrators must update Google Chrome to version 149.0.7827.115 or later. Chrome's automatic update mechanism will deliver this patch; however, policy-driven environments should verify rollout. No workaround mitigates the vulnerability short of patching. Organizations relying on Chrome for sensitive operations should prioritize deployment of this patch across all endpoints.

Patch guidance

Upgrade Google Chrome to version 149.0.7827.115 or any subsequent stable release. Verify the Chrome version via Settings > About Chrome or by running 'google-chrome --version' on Linux. For enterprise deployments, use Chrome policy (via Windows Group Policy, macOS Configuration Profiles, or Linux policy files) to force automatic updates if not already enabled. Test patch deployment in a non-production environment first to ensure no compatibility issues with internal web applications or extensions.

Detection guidance

Monitor Chrome version compliance across endpoints using endpoint detection and response (EDR) tools or mobile device management (MDM) solutions. Log browser crash reports—exploitation may leave traces in crash dumps if the attacker's crafted HTML page triggers memory corruption. Intrusion detection systems should watch for anomalous memory access patterns or unexpected JavaScript execution targeting autofill form fields, though such detection requires deep browser instrumentation. Network-level detection is limited given the vulnerability requires renderer compromise first; focus detection efforts on identifying the initial renderer compromise vector.

Why prioritize this

While the CVSS score is MEDIUM (5.3), this vulnerability should be prioritized for patching within a standard two-week window because it enables direct theft of sensitive autofill data once renderer compromise occurs. In threat environments where browser exploitation is common (espionage, targeted attacks on high-value targets), this is a meaningful stepping stone for attackers. The lack of public exploitation lowers urgency relative to critical vulnerabilities, but the data exfiltration risk and cross-platform impact justify rapid remediation.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects a high confidentiality impact (C:H) constrained by high attack complexity (AC:H) and the requirement for prior compromise (implicit in the renderer process prerequisite). The vector shows no integrity or availability impact—this is purely a disclosure risk. While Chromium's internal severity is 'High,' the CVSS model appropriately downgrades this due to the prerequisite of renderer control, which is itself a security boundary. Organizations should weight this higher than the numerical score suggests if browser exploitation is part of their threat model.

Frequently asked questions