CVE-2026-12029: Chrome Video Use-After-Free Sandbox Escape on Windows

Technical summary

CVE-2026-12029 is a use-after-free vulnerability (CWE-416) in Chrome's video subsystem that affects Windows deployments prior to version 149.0.7827.115. The vulnerability allows a malicious renderer process to reference memory that has already been freed, leading to potential code execution at the system level. The attack surface requires user interaction (visiting a crafted webpage) and relatively complex exploitation conditions (AC:H), but succeeds in crossing security boundaries (S:C) once triggered. The sandbox escape capability makes this a high-severity issue despite its higher complexity requirements.

Business impact

Organizations relying on Chrome for secure web access face elevated risk of full workstation compromise if a user visits a malicious site while a renderer exploit is active in the wild. This is particularly concerning in environments where Chrome is the primary browser for accessing sensitive applications. Successful exploitation could lead to credential theft, lateral movement to network resources, and installation of persistent malware—turning a browser vulnerability into an enterprise breach vector.

Affected systems

Google Chrome on Microsoft Windows prior to version 149.0.7827.115 is vulnerable. While the CVE description specifies Windows, Chrome users on other platforms should verify the patch status in their respective updates, as use-after-free bugs are often cross-platform. Organizations should inventory Chrome deployments and confirm update compliance across all operating systems.

Exploitability

Exploitation requires two preconditions: (1) the renderer process must already be compromised, and (2) the user must visit a page hosting the sandbox escape payload. This two-stage requirement reduces the immediate threat, but does not eliminate it—especially in scenarios where renderer exploits are publicly available or used in targeted campaigns. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no widespread active exploitation at the time of this analysis. However, the sandbox escape nature makes this an attractive post-compromise objective for advanced attackers.

Remediation

Apply Chrome version 149.0.7827.115 or later as soon as possible. This patch addresses the use-after-free condition in the video component. Organizations should prioritize Chrome updates in their patch management workflows, particularly for users who access high-risk websites or handle sensitive data. Automated update mechanisms should be enabled to ensure timely deployment.

Patch guidance

Verify that Chrome installations are updated to version 149.0.7827.115 or later by checking Settings > About Google Chrome, which will display the current version and auto-download available updates. For managed deployments, administrators should push updates through their device management platform (MDM, SCCM, etc.) and confirm compliance reporting within 30 days. Testing in a non-production environment before broad rollout is recommended, though this patch addresses a critical security issue that warrants rapid deployment.

Detection guidance

Endpoint Detection and Response (EDR) tools should monitor for suspicious Chrome renderer process behavior, including unusual memory access patterns or unexpected system calls following video playback or media-heavy webpage visits. Browser crash logs may indicate exploitation attempts; review Chrome crash reports in your telemetry system for patterns correlating with visits to untrusted domains. Network-level detection is limited since the payload is delivered via crafted HTML, but flagging users who visit known malicious or compromised sites for follow-up investigation is prudent.

Why prioritize this

This vulnerability merits high priority due to its sandbox escape capability and high CVSS score (8.3), despite not being actively exploited in the wild. The attack chain—compromising the renderer first, then breaking the sandbox—is a sophisticated but achievable two-stage exploit that advanced threat actors pursue. Organizations should treat this as a critical update cycle, not a routine patch. The combination of high impact (system compromise) and reasonable exploitability (given a renderer compromise) places it near the top of the patch queue.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects: network-based attack vector (AV:N), high complexity due to renderer compromise requirement and user interaction (AC:H, UI:R), ability to change the security context and break sandbox isolation (S:C), and full impact to confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures that while initial access to the renderer is non-trivial, successful exploitation grants near-complete system control. The 'High' Chromium severity designation aligns with the CVSS assessment.

Frequently asked questions