CVE-2026-12019: Chrome Heap Overflow & Sandbox Escape (Linux, ChromeOS)

Technical summary

CVE-2026-12019 is a heap buffer overflow (CWE-787) in the Codecs component of Chromium. The vulnerability exists in the renderer process, which operates within Chrome's sandbox. A remote attacker must first achieve renderer process compromise, then deliver a crafted HTML payload to trigger out-of-bounds heap memory access. Successful exploitation allows sandbox escape, potentially granting access to system resources beyond Chrome's security boundaries. The CVSS 3.1 score of 8.3 (HIGH) reflects the attack's network-reachable vector, moderate complexity (hardware-dependent), requirement for user interaction, and severe consequences across confidentiality, integrity, and availability.

Business impact

Successful exploitation could allow an attacker to move from a compromised Chrome process to full system access. In enterprise environments, this enables lateral movement and privilege escalation beyond the browser sandbox. For users running Chrome on Linux or ChromeOS systems, this represents a critical attack chain: initial web-based compromise followed by sandbox escape and system-level code execution. Organizations relying on Chrome's sandbox as a security boundary for isolated browsing tasks face elevated risk of full system compromise.

Affected systems

The vulnerability affects Google Chrome, ChromeOS, and by extension Linux systems running Chrome. The specific versions impacted are Chrome prior to 149.0.7827.115 on Linux and ChromeOS. The Linux kernel itself is not directly vulnerable; the entry references it because Chrome runs on Linux-based systems. ChromeOS users are particularly affected given the OS's reliance on Chrome as its primary application environment.

Exploitability

Exploitation requires a two-stage attack: first, the attacker must compromise the Chrome renderer process through other means (e.g., separate web vulnerability), then deliver the crafted HTML payload to trigger the heap overflow. This is not a zero-click vulnerability. The moderate attack complexity (AC:H in the CVSS vector) reflects dependencies on system factors or specific conditions. While not currently in CISA's KEV catalog, the sandbox escape potential and the specificity of the required compromise chain currently limit widespread opportunistic exploitation, though targeted attacks against high-value users are plausible once renderer compromise vectors are chained.

Remediation

Update Google Chrome to version 149.0.7827.115 or later on all affected Linux and ChromeOS systems. For enterprises, enforce automatic Chrome updates or use managed deployment tools to ensure rapid patching. ChromeOS typically receives updates automatically; administrators should verify all devices are on the patched build. Organizations cannot rely on network segmentation to mitigate this—successful exploitation occurs entirely within the browser process and would not be blocked by firewalls once a user visits a malicious page.

Patch guidance

Verify Chrome version via chrome://version/ (or Settings > About Chrome, which auto-checks for updates). ChromeOS devices should check Settings > About ChromeOS > Check for updates. Enterprise deployments using Chrome Enterprise should ensure managed update policies target 149.0.7827.115 or later. The patch addresses the heap buffer overflow in the codec handler; no workarounds exist short of disabling affected codec functionality (impractical). Rollback to unpatched versions is not recommended.

Detection guidance

Monitor Chrome crash logs for segmentation faults or out-of-bounds memory access patterns in the renderer process, particularly those originating from codec processing. Intrusion detection systems should flag attempts to access renderer memory outside expected bounds. Behavioral monitoring can detect sandbox escape attempts through system calls that should not originate from Chrome processes (e.g., unexpected file system or network access from renderer context). Log aggregation platforms should flag Chrome crashes with SEGV signals correlated with HTML media element processing.

Why prioritize this

Although the vulnerability requires prior renderer compromise and user interaction, the sandbox escape capability and HIGH Chromium severity designation make this a priority for system administrators. The attack chain—initial web compromise to sandbox escape to system access—represents a significant escalation path. Organizations should treat this as higher priority than the KEV catalog absence might suggest, particularly if threat modeling includes targeted attacks or if users visit high-risk websites. The specificity of the attack (codec handling, Linux/ChromeOS focus) also suggests targeted rather than mass-exploitation scenarios.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects: network-reachable attack vector (AV:N); moderate complexity due to hardware or system-specific conditions (AC:H); no privilege requirement (PR:N); requirement for user interaction to visit a malicious page (UI:R); scope change indicating the impact extends beyond the vulnerable component to the entire system (S:C); and high impact on all three CIA triad elements (C:H/I:H/A:H). The score appropriately captures the severity of sandbox escape despite the prerequisite renderer compromise.

Frequently asked questions