CVE-2026-12444: Chrome Chromoting Out-of-Bounds Read on Windows – Patch Guidance

Technical summary

This vulnerability is classified as CWE-125 (Out-of-Bounds Read) and manifests in the Chromoting subsystem of Google Chrome. The flaw allows an unprivileged local attacker to trigger an out-of-bounds read in Chrome's process memory by delivering a specially crafted file. The attack requires user interaction—specifically, opening or interacting with the malicious file in a way that invokes Chromoting functionality. Because the vulnerability only permits reading (not writing or code execution) and does not affect process stability, the CVSS v3.1 score is 5.5 (Medium severity). The attack surface is limited to local access contexts, and successful exploitation depends on social engineering or user negligence to open a malicious file.

Business impact

While this vulnerability cannot be leveraged for remote code execution or denial of service, its primary business risk is information disclosure. Organizations relying on Chrome for remote access scenarios—particularly those using Chromoting for employee remote work, IT support, or cloud-based thin clients—face potential exposure of sensitive session data, credentials, or cached information resident in Chrome's memory. The impact is heightened in environments where multiple sensitive sessions are active on the same machine, or where Chrome handles authentication tokens for corporate systems. The need to patch across potentially thousands of Chrome installations also represents operational overhead.

Affected systems

The vulnerability affects Google Chrome on Windows systems running version 149.0.7827.155 or earlier. While the source data lists macOS, Linux, and Windows as potential affected platforms, the description specifically references Chrome on Windows; organizations should verify Chrome's status on other operating systems through the official Google Chrome Security Release. Any Windows machine with an unpatched Chrome installation and Chromoting functionality enabled is potentially vulnerable.

Exploitability

Exploitation requires local system access and user interaction—an attacker cannot trigger this vulnerability remotely. The attacker must craft and deliver a malicious file, then wait for a user to open or interact with it in a manner that engages Chrome's Chromoting code path. This dependency on user action and local presence significantly reduces real-world exploitability compared to remote, user-interaction-free vulnerabilities. No public exploit code is known to exist, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting limited active exploitation.

Remediation

Update Google Chrome on Windows to version 149.0.7827.155 or later. Organizations should prioritize deployment across all managed Chrome instances, particularly in endpoints where Chromoting is enabled or where users handle files from untrusted sources. Verify the patched version through Google's official release notes and your software distribution system. For unmanaged or bring-your-own-device (BYOD) environments, consider using Chrome's automatic update mechanism or endpoint management policies to enforce timely patching.

Patch guidance

Deploy Chrome version 149.0.7827.155 or later to all Windows systems running affected versions. Most enterprise deployments can enforce this via group policies or endpoint management platforms. Home users should enable automatic Chrome updates (enabled by default). Verify successful patching by checking Chrome's version string in Settings > About Chrome, which will trigger automatic update and display the installed version. Organizations managing large fleets should test patch deployment in a small cohort before organization-wide rollout to ensure no compatibility issues with critical applications.

Detection guidance

Monitor for Chrome process crashes or anomalous memory access patterns on Windows endpoints, though such indicators are subtle for out-of-bounds reads that do not cause immediate termination. More practically, audit Chrome version inventory across your organization using endpoint detection and response (EDR) tools or mobile device management (MDM) solutions to identify machines still running vulnerable versions. Look for deployment of suspicious files to endpoints combined with Chrome activity—though file-based detection is difficult without knowing the malicious file's exact characteristics. Prioritize detection based on user behavior: flag unusual file handling in Chromoting-enabled environments or by users working with external or untrusted documents.

Why prioritize this

Although the CVSS score is Medium (5.5), this vulnerability merits timely attention because it affects a widely deployed application (Chrome) in a high-value use case (remote access via Chromoting). Information disclosure vulnerabilities, while less immediately critical than code execution flaws, can serve as stepping stones to more serious compromises if exposed data includes authentication material. The local+user-interaction requirement limits urgency relative to remote, user-free exploits, but the ease of distribution (a malicious file) and the breadth of Chrome's deployment justify prioritizing this over lower-impact issues. Organizations should aim to patch within 2–4 weeks unless they operate particularly restrictive Chromoting policies.

Risk score, explained

The CVSS v3.1 score of 5.5 reflects a Medium-severity vulnerability. The score accounts for: (1) local attack vector (AV:L)—limiting reach to users with system access or via file-based delivery; (2) low attack complexity (AC:L)—the malicious file is straightforward to craft; (3) no privilege requirement (PR:N); (4) requirement for user interaction (UI:R)—the user must open or interact with the file; (5) unchanged scope (S:U); (6) high confidentiality impact (C:H)—sensitive memory may be exposed; and (7) no integrity or availability impact (I:N/A:N)—the attacker cannot modify data or crash the process reliably. The High Chromium security severity designation reflects the browser vendor's assessment of the issue's importance within their ecosystem.

Frequently asked questions