CVE-2026-12441: Critical Use-After-Free in Chrome File Input on Linux

Technical summary

CVE-2026-12441 is a use-after-free (CWE-416) flaw in Chrome's file input subsystem on Linux. When processing a specially crafted HTML page, the browser fails to properly manage memory references, allowing freed memory to be accessed and modified. This can lead to heap corruption and, under favorable conditions, code execution within the browser's context. The vulnerability is rated Critical by the Chromium security team and assigned a CVSS 3.1 score of 8.8 (HIGH severity) with a network attack vector, low complexity, no privilege requirement, and user interaction needed.

Business impact

Successful exploitation allows attackers to compromise user systems running vulnerable Chrome installations on Linux. Potential impacts include theft of sensitive data, credential harvesting, malware installation, and lateral movement within corporate networks. Organizations with Linux-based developer or analyst populations, or those supporting Linux desktop environments, face elevated risk. The requirement for user interaction (visiting a malicious page) moderates the attack surface but does not eliminate it, especially in social engineering scenarios.

Affected systems

Google Chrome on Linux systems running versions prior to 149.0.7827.155 are affected. Users on Windows and macOS running the same Chrome version should verify patch status independently, as this CVE specifically references the Linux variant. The Linux kernel itself is listed as an affected product in the source data; organizations should verify whether this indicates a separate kernel-level exposure or if it is a metadata artifact.

Exploitability

The vulnerability requires a user to visit a crafted HTML page, making it suitable for phishing campaigns, malvertising, or drive-by compromise scenarios. No public exploit code is known to be available at this time, and the vulnerability is not tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the Critical severity rating and straightforward attack vector suggest motivated threat actors will develop functional exploits; defense should not rely on exploit scarcity.

Remediation

Update Google Chrome to version 149.0.7827.155 or later on all Linux systems. Organizations should prioritize this patch for systems frequently visited by employees or exposed to untrusted content. Implement update mechanisms—either through Chrome's built-in auto-update or enterprise deployment tools—and verify patch application across the fleet. Consider deploying browser isolation technologies for high-risk user populations pending immediate patching.

Patch guidance

Google Chrome auto-updates are typically enabled by default; users can manually verify their version by navigating to chrome://settings/help. Enterprise deployments should consult Chromium's release notes and Google's enterprise update documentation to confirm version 149.0.7827.155 or later is deployed. Test patches in non-production environments first if Chrome is integrated with critical workflows. Monitor for any regression or functionality issues post-patch, though this is unlikely for a security-driven release.

Detection guidance

Monitor process execution for Chrome instances running versions below 149.0.7827.155 using endpoint detection tools or asset inventory systems. Watch for suspicious file input interactions or crafted HTML rendering in browser logs if available. Implement network-level protections such as blocking known malicious file hosts or command-and-control infrastructure. Consider deploying DNS filtering and web content filtering to reduce user exposure to attack vectors. Behavioral analytics may flag unusual heap corruption signatures if advanced EDR tools are in place.

Why prioritize this

This vulnerability merits immediate attention due to its Critical Chromium rating, high CVSS score, network-based attack vector, and the widespread use of Chrome on Linux development and security teams. While KEV status is currently negative (not listed as actively exploited), the straightforward nature of use-after-free flaws and the mature state of exploitation techniques mean a functional exploit could be developed or deployed quickly. Organizations running Chrome on Linux for any user-facing or security-sensitive role should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high severity due to confidentiality, integrity, and availability impacts, combined with network accessibility and low attack complexity. The lone mitigating factor is the requirement for user interaction. The Chromium project's Critical severity designation underscores internal assessment of exploitability and real-world risk. Organizations should not be reassured by the HIGH (rather than CRITICAL) CVSS severity label; the Chromium severity is the more authoritative signal in this context.

Frequently asked questions