CVE-2026-12445: Use-After-Free in Google Chrome Extensions (High Severity)

Technical summary

This vulnerability (CWE-416: Use After Free) exists in Chrome's extension handling code. When a malicious extension is loaded, it can reference memory that has already been freed, corrupting the heap. The use-after-free condition allows an attacker to read sensitive data from memory, modify heap structures, or execute arbitrary code with the privileges of the Chrome process. The CVSS 3.1 score of 7.5 (High) reflects the requirement for user interaction (installing the extension) balanced against the severity of potential impact—confidentiality, integrity, and availability are all compromised.

Business impact

If exploited, an attacker gains the ability to execute code within the Chrome process context on affected systems. This can lead to theft of credentials, session tokens, and sensitive data accessed through the browser; installation of persistent malware; lateral movement to other systems on the network; or use as a pivot point in a targeted campaign. Organizations with Chromebook deployments or heavy Chrome reliance should treat this as a priority, especially if their users have low security awareness around extension installation.

Affected systems

Google Chrome on Windows, macOS, and Linux distributions are vulnerable if running versions prior to 149.0.7827.155. The vulnerability affects all Chrome variants (stable, beta, dev) on these operating systems. Systems with automatic updates enabled may already be protected; those with manual or deferred update policies remain at risk until patched.

Exploitability

Exploitation requires social engineering to convince a user to install a malicious extension. The attacker has no direct network attack path—the vulnerability cannot be triggered by visiting a malicious website or through drive-by attacks. However, the barrier to exploitation is moderate: attackers can host malicious extensions on third-party app stores, use email phishing, or compromise legitimate extension update channels. Once installed, the malicious extension automatically gains the ability to trigger the use-after-free condition. The vulnerability is not currently tracked in the CISA KEV catalog, suggesting active exploitation in the wild has not yet been widely documented as of the publication date.

Remediation

Update Google Chrome to version 149.0.7827.155 or later immediately. Users should review installed extensions, remove any that are unfamiliar or no longer used, and be cautious when granting extension permissions. Organizations should enforce auto-update policies for Chrome and consider using managed Chrome policies to restrict which extensions can be installed (via an extension blocklist/allowlist). For Chromebook environments, ensure device policy pushes updates automatically.

Patch guidance

Google Chrome updates are typically rolled out automatically to users on the stable channel. To verify you are patched, navigate to Chrome menu → Help → About Google Chrome; if your version is 149.0.7827.155 or later, you are protected. Enterprise administrators should verify their Chrome management console reflects the updated version across their fleet. Some organizations may need to manually trigger updates or verify that update policies are correctly configured. Consult Google's official Chrome release notes and your Chrome Enterprise deployment documentation for version verification procedures.

Detection guidance

Monitor for unusual extension installation activity, especially from non-official stores. Review Chrome extension audit logs in enterprise environments (if Chrome management is in use) for unexpected or unauthorized extensions. Watch for processes spawned by the Chrome extension process that may indicate post-exploitation activity. If suspicious extensions are detected, isolate the affected system and review browsing history and system logs for indicators of compromise. Note that the vulnerability itself may not leave obvious log artifacts—detection relies primarily on spotting the malicious extension before or immediately after installation.

Why prioritize this

This vulnerability merits immediate attention because it combines a user-interaction attack vector with high-severity impact (heap corruption leading to code execution). While not yet listed in CISA's KEV catalog, the Chromium security team assigned it High severity, indicating confidence in real-world exploitability. Chrome's ubiquity in both consumer and enterprise environments amplifies the risk. The ease of distributing a malicious extension via social engineering makes this a likely target for both financially motivated and nation-state adversaries.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects High severity due to the scope of impact: confidentiality, integrity, and availability are all at risk (C:H, I:H, A:H). The score is moderated by the requirement for user interaction (UI:R) and higher complexity in achieving exploitation (AC:H), but the use-after-free primitive is a well-understood attack technique. An attacker with code execution in the Chrome process can exfiltrate data, modify stored credentials, or degrade system availability—hence all three impact categories are fully compromised.

Frequently asked questions