CVE-2026-12437: Chrome WebShare Use-After-Free Sandbox Escape on Windows

Technical summary

CVE-2026-12437 is a use-after-free vulnerability (CWE-416) in the WebShare implementation within Google Chrome versions prior to 149.0.7827.155 on Windows. The vulnerability allows an attacker with renderer process compromise to craft a malicious HTML page that triggers improper memory handling in WebShare, potentially achieving sandbox escape. The Chromium project classified this as Critical severity due to its sandbox-escape nature, though the CVSS 3.1 score of 8.3 reflects the prerequisite of renderer compromise.

Business impact

This vulnerability poses a significant risk to organizations where users access untrusted content in Chrome, particularly in environments handling sensitive data. The sandbox-escape capability means an attacker could move from a limited renderer context to full system privileges, potentially exfiltrating data, installing malware, or pivoting to network resources. The high CVSS score and Critical Chromium rating warrant prompt patching despite the renderer-compromise prerequisite.

Affected systems

Google Chrome versions before 149.0.7827.155 on Windows are vulnerable. Users of other operating systems (macOS, Linux, ChromeOS) should verify patch status through Google's official security advisories, as this CVE explicitly references Windows. Organizations running older Chrome versions in managed or kiosk environments face particular risk.

Exploitability

Exploitation requires two preconditions: first, the attacker must already control Chrome's renderer process (potentially via another browser vulnerability or social engineering), and second, the user must visit a specially crafted webpage. While not trivially exploitable in isolation, the use-after-free in a widely-used feature like WebShare makes this an attractive second-stage payload for multi-stage attacks. Public exploit code availability is unknown at publication time.

Remediation

Update Google Chrome to version 149.0.7827.155 or later immediately. This is a priority patch due to the Critical Chromium severity classification. Verify the update is installed via Chrome's Settings > About Chrome, which auto-updates on modern installations. For managed environments, deploy the update via your Chrome management console or MDM solution.

Patch guidance

Chrome typically auto-updates on next browser restart, but you can manually trigger updates via Settings > About Chrome. For enterprise deployments, use Google Chrome's managed update capabilities (via Group Policy on Windows domains or mobile device management solutions). Verify successful patching by confirming the version number matches 149.0.7827.155 or higher. There is no workaround; patching is the only mitigation.

Detection guidance

Monitor for unusual Chrome process behavior, particularly unexpected privilege escalation or renderer process crash logs. Web application firewalls can log suspicious WebShare API calls, though this is advanced. Endpoint detection and response (EDR) solutions should flag attempts to access sensitive files or registry keys following Chrome process anomalies. Consider blocking or restricting access to known malicious WebShare payloads if they emerge.

Why prioritize this

Despite requiring renderer compromise as a prerequisite, this vulnerability merits high-priority patching because: (1) Chromium rated it Critical, indicating serious sandbox-escape implications; (2) WebShare is a commonly-used API, expanding attack surface; (3) it enables privilege escalation post-compromise, making it valuable in multi-stage attacks; and (4) Chrome's wide deployment means many systems are affected.

Risk score, explained

The CVSS 8.3 (HIGH) score reflects the severity of sandbox escape and high impact to confidentiality, integrity, and availability, but is tempered by the need for prior renderer compromise (AC:H, PR:N in context of renderer). The Chromium Critical rating acknowledges the sandbox-escape risk. This is a high-priority vulnerability for Windows Chrome users, though it requires an initial attack to be valuable.

Frequently asked questions