CVE-2026-12018: Chrome Mojo Privilege Escalation on Windows

Technical summary

CVE-2026-12018 is an improper implementation vulnerability in Chrome's Mojo inter-process communication framework. The defect permits OS-level privilege escalation when a local attacker supplies a crafted file that exploits the weakness. The vulnerability requires user interaction (opening the file) but does not require prior authentication or network access, making it a local attack surface with high impact to confidentiality, integrity, and availability.

Business impact

Successful exploitation grants an attacker administrator-level control of affected Windows systems running vulnerable Chrome versions. This enables wholesale compromise of system and user data, lateral movement to network resources, installation of persistent backdoors, and potential disruption of critical business operations. Organizations relying on Chrome for sensitive workloads face elevated risk of data exfiltration and operational downtime.

Affected systems

Google Chrome on Windows prior to version 149.0.7827.115 is directly affected. Any Windows machine running an older Chrome build is at risk if users are exposed to attacker-controlled files. This includes enterprise deployments with managed Chrome instances, consumer devices, and kiosk systems.

Exploitability

Exploitation requires local file system access and user interaction—specifically, the user must open a malicious file in Chrome. The attack does not rely on network services or require the attacker to already have elevated privileges. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects the low complexity, though the network attack vector and user interaction requirement mean real-world exploitation is context-dependent. This is not yet tracked in the CISA KEV catalog.

Remediation

Update Google Chrome to version 149.0.7827.115 or later on all Windows systems. For organizations with managed Chrome deployments, push the update through your enterprise management console (Chrome Enterprise, Intune, or equivalent). Simultaneously, reinforce user awareness training around opening untrusted files and disable automatic file execution where possible.

Patch guidance

Chrome will auto-update to version 149.0.7827.115 or higher on restart for most users. Verify the installed version by navigating to Chrome menu > Help > About Google Chrome. Enterprise administrators should validate patch deployment via group policy or mobile device management reporting. No interim mitigations are documented; patching is the primary control.

Detection guidance

Monitor Windows event logs for suspicious file access attempts that correlate with Chrome process execution. Review file system permissions and audit logs for any unauthorized privilege escalation events. Network teams should watch for unusual outbound connections from Chrome processes post-exploitation. Endpoint detection and response (EDR) tools should flag attempts to elevate privileges from Chrome's sandboxed context.

Why prioritize this

This vulnerability merits urgent attention due to its high CVSS score (8.8), local privilege escalation capability, and the ubiquity of Chrome in enterprise environments. The low complexity and reliance on user interaction (rather than a network-based trigger) mean it is a credible threat in any environment where employees handle files from external or untrusted sources. Although not yet exploited in the wild according to KEV status, the attack surface is broad.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability, combined with low attack complexity and no authentication requirement. The user interaction requirement and local-only attack vector prevent a critical (9.0+) rating. The Mojo implementation flaw is a design issue rather than a simple bounds check, suggesting potential for variant exploitation if not comprehensively patched.

Frequently asked questions