CVE-2026-12035: Critical Use-After-Free in Google Chrome Windows

Technical summary

CVE-2026-12035 is a use-after-free (CWE-416) vulnerability in Chrome's Views subsystem on Windows. The flaw exists in memory management code where a Views object is accessed after it has been freed, leading to a write-primitive that can corrupt the heap. An attacker crafts a malicious HTML page that, when loaded and interacted with by a victim, triggers the use-after-free condition. The vulnerability affects Chrome versions prior to 149.0.7827.115. The attack surface is limited to Windows systems running vulnerable Chrome versions, and the interaction requirement (user must engage with the page) provides a modest mitigation factor, though social engineering can lower that bar significantly.

Business impact

Exploitation could result in unauthorized code execution within the Chrome sandbox, though that sandbox may also be bypassed depending on the specific heap corruption primitive available to the attacker. A successful compromise could lead to credential theft from the browser, access to locally stored data, or lateral movement to other systems on the network. Organizations relying on Chrome for sensitive work face risk of data exfiltration and supply-chain targeting if employees visit compromised websites. The interaction requirement means this is less immediately dangerous than a wormable flaw, but still warrants urgent patching given Chrome's ubiquity in enterprise and consumer environments.

Affected systems

This vulnerability affects Google Chrome on Microsoft Windows. The vulnerability is present in all Chrome versions prior to 149.0.7827.115. Chrome on macOS and Linux are not affected. Windows systems running up-to-date Chrome are protected; users and administrators should verify their version against the patched release number. Organizations with mixed Chrome deployments (Windows, Mac, Linux) need only address Windows infrastructure.

Exploitability

Exploitability is high in practice. The attack requires only a network connection and user interaction with a crafted webpage—no special credentials, authentication, or system-level access is needed. The attacker can deliver the malicious page via email, advertising networks, compromised legitimate websites, or watering-hole attacks. The CVSS score of 8.8 reflects this ease of attack (AV:N, AC:L, PR:N, UI:R). The use-after-free condition is likely triggered reliably through JavaScript or HTML manipulation. This is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the last data refresh, but the combination of low attack complexity and high impact makes it an attractive target for threat actors.

Remediation

Immediate action is required: update Google Chrome to version 149.0.7827.115 or later on all Windows systems. Chrome's auto-update feature typically deploys patches within 24 hours, but administrators should verify deployment in managed environments. For enterprise environments, use Chrome's managed policies to force updates or restrict older versions. Users can manually check Chrome's version at chrome://settings/help, which will trigger an update check and restart if patches are available. There is no workaround other than disabling Chrome or avoiding untrusted websites.

Patch guidance

Deploy Chrome 149.0.7827.115 or later as soon as it is available in your environment. Chrome on Windows checks for updates automatically and applies them on restart, but users should be encouraged to restart their browsers promptly after updates are detected. In managed environments, use Google Admin Console or group policy to enforce rapid rollout. Verify patch deployment by sampling a cross-section of machines and confirming they report version 149.0.7827.115 or later via chrome://version or system inventory tools. Linux and macOS systems do not require action for this specific CVE, but should remain on current versions for other fixes.

Detection guidance

Monitor for active exploitation by reviewing Chrome crash logs and browser histories for visits to unusual or suspicious domains immediately preceding crashes or unexpected behavior. Network detection should focus on identifying delivery mechanisms for malicious HTML—suspicious JavaScript payloads, unexpected network traffic from Chrome processes, or unusual file access patterns post-compromise. Endpoint detection and response (EDR) tools should flag heap corruption signatures or unusual process behavior (privilege escalation, credential access) following Chrome execution. Defenders with access to enterprise Chrome sync data can audit browsing history for visits to known malicious sites. User reporting of unexpected Chrome crashes or performance degradation, especially after visiting unfamiliar websites, is an important signal.

Why prioritize this

This vulnerability should be patched on Windows systems within 24-48 hours because: (1) it offers remote code execution potential via heap corruption; (2) attack complexity is low and user interaction, while required, is easily socially engineered; (3) Chrome's market share means millions of potential targets; (4) no exploit code has been publicly disclosed, but the design is straightforward enough that weaponization is probable once the patch is analyzed. Organizations processing sensitive data or operating in high-threat environments (financial, defense, government) should prioritize this higher; consumer-facing organizations should ensure employee machines are patched urgently as well.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: Network attack vector (no local access required), Low attack complexity (no special conditions), No privileges required, User interaction required (modest mitigation), Unchanged scope, and High impact on Confidentiality, Integrity, and Availability. The score appropriately captures the severity of a reliable, remotely triggered memory corruption flaw in a ubiquitous application. The interaction requirement prevents a CRITICAL rating (9.8+), but the ease of triggering interaction and the breadth of potential victims justify the HIGH classification.

Frequently asked questions