CVE-2026-12443: Critical Use-After-Free in Chrome WebAuth—Patch Now

Technical summary

CVE-2026-12443 is a use-after-free memory safety vulnerability (CWE-416) in Chrome's WebAuthn implementation. The vulnerability allows remote code execution when a specially crafted HTML page triggers unsafe memory access in the authentication handler. The attack requires user interaction (clicking a link or visiting a page) but no special privileges. The vulnerability was assigned Critical severity by the Chromium security team and carries a CVSS 3.1 score of 8.8, reflecting the combination of network-based attack vector, low attack complexity, and high impact across confidentiality, integrity, and availability.

Business impact

Successful exploitation of this vulnerability could allow attackers to gain unauthorized code execution within the Chrome process, potentially leading to theft of sensitive data (passwords, session tokens, personal information), installation of malware, or lateral movement within corporate environments. Organizations where employees use Chrome for web-based applications or access sensitive services face elevated risk of account compromise and data exfiltration. The low attack complexity and requirement for only user interaction—not social engineering or phishing—mean this vulnerability poses a material threat to endpoint security posture.

Affected systems

Google Chrome versions prior to 149.0.7827.155 are directly affected. Because Chrome is cross-platform, the vulnerability impacts users on Windows, macOS, and Linux systems running vulnerable versions. The listing of Apple macOS, Linux kernel, and Microsoft Windows as affected indicates the vulnerability is not specific to one operating system implementation.

Exploitability

This vulnerability is exploitable without authentication or elevated privileges. An attacker needs only to host a malicious HTML page and convince a user to visit it—via a link, email, or advertisement. The low attack complexity means reliable exploitation is straightforward for a competent attacker. However, the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no evidence of active, widespread exploitation in the wild as of the publication date.

Remediation

Immediate patching is the primary remediation. Users and administrators should update Google Chrome to version 149.0.7827.155 or later. For organizations managing Chrome deployments, configure automatic updates or enforce a mandatory update policy. Until patching is complete, end-users should avoid clicking suspicious links and visiting untrusted websites, though this is a defense-in-depth measure and not a substitute for patching.

Patch guidance

Deploy Chrome version 149.0.7827.155 or later across all endpoints. Chrome's auto-update mechanism typically handles this automatically, but verify completion through your device management or browser telemetry tools. For enterprise environments using Chrome policies, confirm that the MinimumChromeVersion policy is set to 149.0.7827.155 or higher. Test the patch in a pilot environment if your organization has custom WebAuthn implementations or dependencies on specific Chrome behavior before full rollout.

Detection guidance

Monitor for Chrome version compliance using endpoint detection and response (EDR) tools, mobile device management (MDM) platforms, or asset inventory tools. Look for client-side telemetry indicating failed Chrome auto-updates or user machines running versions below 149.0.7827.155. At the web application layer, review server-side logs for unusual WebAuthn authentication attempts, authentication errors, or evidence of abnormal user sessions immediately following unusual browser activity. Network indicators are limited since the exploit leverages the browser's own functionality; focus detection on post-compromise forensics.

Why prioritize this

This vulnerability merits high priority patching due to the combination of critical Chromium severity, remote exploitability without authentication, low attack complexity, and the ubiquity of Chrome in both consumer and enterprise environments. The lack of KEV listing indicates active exploitation may not yet be widespread, creating a window to patch before attackers weaponize this flaw at scale. Organizations should treat this as critical infrastructure work within the first 48–72 hours of patch availability.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a remote, unauthenticated attack vector with low complexity and high impact across all three security dimensions (confidentiality, integrity, availability). While the user interaction requirement prevents a perfect 10.0, it is a realistic attack precondition in a browser-based threat model. The score appropriately emphasizes the severity without overstating exploitability barriers.

Frequently asked questions