CVE-2026-12446: Chrome Password Manager Cross-Origin Data Leak – Exploit, Patch & Detection

Technical summary

CVE-2026-12446 is an inappropriate implementation vulnerability in the password handling component of Chromium-based browsers. It falls under CWE-863 (Incorrect Authorization) and allows cross-origin data leakage through a crafted HTML page. The flaw exists in how the browser's password manager or related authentication mechanisms validate and enforce cross-origin boundaries. An attacker-controlled web page can exploit this to access sensitive data from other origins when the victim visits the malicious page. The CVSS v3.1 score of 4.3 (MEDIUM) reflects low attack complexity and no special privileges needed, but limited impact scope (confidentiality only) and mandatory user interaction.

Business impact

While the CVSS score is moderate, the risk centers on credential and session data exposure. If the leaked cross-origin data includes cached credentials, authentication tokens, or personal information from other sites, attackers gain a foothold for further compromise—lateral movement within the organization, account takeover, or supply-chain attacks if employees visit the malicious site. The user interaction requirement limits mass exploitation, but targeted spear-phishing campaigns pose a real threat. Organizations relying on Chrome for sensitive work (research, finance, healthcare) should treat this as a priority update.

Affected systems

All Google Chrome installations prior to version 149.0.7827.155 are vulnerable. The vulnerability also affects the underlying operating systems and browsers on which Chrome runs: Apple macOS, Linux kernel variants, and Microsoft Windows. This spans both Windows and macOS endpoints commonly found in enterprise environments, as well as Linux systems running Chrome or Chromium derivatives.

Exploitability

The attack vector is network-based and requires no special privileges or complex setup. However, it mandates user interaction—the victim must visit or be redirected to a crafted HTML page. This limits opportunistic mass exploitation but makes it an effective vector for targeted attacks. An attacker could distribute the malicious link via email, social engineering, or compromised advertising networks. The attack does not require the user to click a button or complete any additional action beyond visiting the page itself, making it relatively straightforward once the victim is on the attacker's site.

Remediation

Update Google Chrome to version 149.0.7827.155 or later immediately. The patch is the primary mitigation; no workarounds are documented. Organizations should enforce Chrome auto-update policies if not already enabled. For managed environments, verify deployment of patched builds across all endpoints. Users on macOS, Windows, and Linux should all prioritize this update.

Patch guidance

Apply Chrome version 149.0.7827.155 or later. Verify this version in Chrome's About page (chrome://about or Help > About Google Chrome), which will auto-check for updates. In enterprise environments using Google Admin Console or third-party endpoint management (Intune, Jamf, etc.), push this minimum version as a requirement. Test in a small pilot group first to confirm no compatibility issues with internal web applications, though this is a browser-core security patch unlikely to cause functional regressions.

Detection guidance

Monitor for Chrome versions below 149.0.7827.155 in your asset inventory and endpoint detection systems. If historical logs are available, look for user access to suspicious or unknown external websites shortly before anomalous cross-origin requests or data exfiltration alerts. In network monitoring, watch for unusual egress connections from Chrome processes to unexpected destinations. EDR tools can flag instances of Chrome with outdated version signatures. Cross-reference any alerts with user browsing history to identify whether the user visited a phishing link or malicious site.

Why prioritize this

This vulnerability merits prompt patching despite its MEDIUM severity score. The cross-origin data leakage risk is subtle but serious—it can expose session tokens, cached credentials, or personal identifiable information (PII) without obvious user warning. The attack requires only network access and user interaction, no special tools. Targeted campaigns are feasible. Organizations with high-value intellectual property, financial, or healthcare data should treat this as higher priority. Consumer-facing or R&D teams are at particular risk.

Risk score, explained

The CVSS 4.3 score reflects the narrow but real threat model: no attack complexity, no privilege escalation required, and network reachability. However, mandatory user interaction (clicking a link or visiting a page) reduces the automatic exploitation potential. The impact is limited to confidentiality loss with no integrity or availability impact. The score appropriately positions this as non-critical but not negligible—many organizations treat MEDIUM severity browser patches as must-do in their next patch cycle, especially for core components like password handling.

Frequently asked questions