CVE-2026-12020: Use-After-Free in Chrome Autofill on macOS – Patch Advisory

Technical summary

CVE-2026-12020 is a use-after-free (CWE-416) flaw in the Autofill subsystem of Google Chrome on macOS. The vulnerability arises when the browser attempts to access memory that has been freed, leading to heap corruption. An attacker can leverage this through a specially crafted HTML page delivered via a network vector, exploiting the use-after-free condition without requiring elevated privileges or special browser configurations. The flaw carries Chromium's High severity classification and has a CVSS 3.1 score of 8.8, reflecting the combination of network accessibility, low attack complexity, and high impact across confidentiality, integrity, and availability.

Business impact

Organizations with macOS-based workforces face meaningful risk. A compromised Chrome process could lead to credential theft via the Autofill mechanism, data exfiltration, or lateral movement within a corporate environment if the browser runs with elevated permissions or shares network access to internal systems. Incident response teams should anticipate potential user-initiated compromise vectors, particularly if employees visit untrusted websites. The need for rapid patching across a user base may also stress deployment and change management processes.

Affected systems

Google Chrome versions prior to 149.0.7827.115 on macOS are affected. macOS itself is not vulnerable; rather, it is the host operating system on which the vulnerable Chrome browser runs. Windows and Linux versions of Chrome are not impacted by this specific vulnerability, though users on all platforms should maintain up-to-date browser versions as a general best practice.

Exploitability

Exploitation requires user interaction (visiting a malicious website), which is reflected in the CVSS vector. However, the bar for enticing a user to visit such a site is low—social engineering, search engine poisoning, or malicious advertisements are practical attack vectors. No special browser extensions, unusual user settings, or system misconfigurations are needed. The vulnerability is likely to attract tooling and weaponization efforts once details proliferate, particularly given the high impact potential.

Remediation

Update Google Chrome to version 149.0.7827.115 or later immediately. On macOS, users can enable automatic updates in Chrome settings (Settings > About Google Chrome) to receive patches automatically. Organizations should prioritize this update for all macOS devices, especially those used by high-risk users (executives, researchers, or those handling sensitive data). Verify the update has been applied by checking Chrome's version in Settings > About Google Chrome.

Patch guidance

Google Chrome should automatically prompt users to update when a new version is available. Administrators managing Chrome deployments should use Mobile Device Management (MDM) or endpoint management tools to enforce the update across their macOS fleet. For organizations using configuration management, verify that the Chrome update policy is set to 'Always allow updates' or equivalent. Test the patch in a limited environment before broad rollout if your organization has specialized Chrome extensions or web applications that may be affected by browser updates.

Detection guidance

Monitor for Chrome crash logs or application errors on macOS endpoints, as exploitation may result in browser crashes. Inspect web proxy and DNS logs for suspicious website visits, though attackers may use legitimate-appearing domains or watering-hole attacks to obscure malicious traffic. Endpoint Detection and Response (EDR) tools should monitor for unexpected child process spawning from the Chrome process or unusual network connections originating from the browser. Consider blocking or warning users visiting known malicious domains through web filtering solutions.

Why prioritize this

This vulnerability merits urgent patching due to its high CVSS score (8.8), ease of exploitation via web browsing, and potential for arbitrary code execution. The requirement for user interaction is a minor friction point but not a significant blocker given the ubiquity of web browsing. While not yet on the CISA KEV catalog, the combination of network-based attack vector and high impact makes it attractive for weaponization. Organizations should treat this as a priority update, particularly for at-risk user populations.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) Network accessibility (AV:N) with no authentication required (PR:N), allowing remote exploitation; (2) Low attack complexity (AC:L), meaning no special conditions are needed; (3) User interaction requirement (UI:R), which slightly lowers the score but remains practical for attackers; (4) Unchanged scope (S:U), limiting blast radius to the Chrome process; and (5) high impact across all three security dimensions—confidentiality (credential/data theft), integrity (code execution), and availability (process crash). The score appropriately captures a serious but not critical-infrastructure-level threat.

Frequently asked questions