CVE-2026-12447: Chrome WebRTC Heap Overflow RCE – Urgent Patch Required

Technical summary

CVE-2026-12447 is a heap buffer overflow (CWE-122) in the WebRTC module of Google Chrome that enables remote code execution within a sandboxed context. The vulnerability exists in Chrome versions prior to 149.0.7827.155 and is triggered by processing a crafted HTML page. The attack vector is network-based with no authentication required, though it does require user interaction. The Chromium security team classified this as High severity due to the combination of remote reachability, ease of exploitation, and impact on confidentiality, integrity, and availability.

Business impact

Organizations whose employees use Chrome for daily work face potential data exfiltration if a user visits a compromised or attacker-controlled website. The sandboxed nature of Chrome limits the direct risk to the host system, but a successful exploit could expose sensitive information accessed through the browser, bypass authentication tokens stored in Chrome, or serve as a staging point for secondary attacks. This is particularly concerning for organizations handling sensitive information through web applications.

Affected systems

The vulnerability affects Google Chrome on multiple operating systems: Windows, macOS, and Linux. Any Chrome installation running version 149.0.7827.155 or earlier is vulnerable. This includes Chrome on enterprise-managed endpoints, personal devices used for work, and any chromium-based browsers that incorporate affected WebRTC code. The underlying platforms (Windows, macOS, Linux kernel) are listed in the advisory but are not directly vulnerable; they are affected as host systems for the vulnerable browser.

Exploitability

This vulnerability has a CVSS score of 8.8 (High) with a network attack vector, low attack complexity, and no privilege requirement. Exploitation requires user interaction—an attacker must convince or trick a user to visit a malicious website. The barrier to exploitation is moderate due to the user interaction requirement, but the ease of delivery (via link, email, ad redirect, or compromised legitimate website) makes this a practical risk. As of the source data date, this vulnerability is not documented in CISA's Known Exploited Vulnerabilities catalog, though organizations should monitor for active exploitation attempts.

Remediation

Users and administrators must update Google Chrome to version 149.0.7827.155 or later. Chrome's automatic update mechanism will handle this for most users, but verification is recommended. IT teams should verify the update has deployed across managed devices and confirm that outdated versions are no longer in use. Interim risk reduction measures include disabling WebRTC in browser settings (though this may break some legitimate web applications) and blocking access to untrusted websites via policy or network controls.

Patch guidance

Apply Chrome version 149.0.7827.155 or later across all endpoints. Chrome typically updates automatically in the background, but users can force an update through the Settings > About Chrome menu, which will show the installed version and apply pending updates. For enterprise deployments, verify that Chrome update policies are enabled and monitor the Chrome version dashboard to confirm rollout completion. Test critical web applications after patching to ensure WebRTC-dependent features continue to function correctly.

Detection guidance

Monitor for signs of exploitation including unexpected Chrome process crashes, unusual CPU or memory spikes during web browsing, and authentication tokens or session cookies being used from unexpected locations post-compromise. Endpoint detection and response (EDR) tools should monitor for heap spray activity and unusual memory access patterns in Chrome processes. At the network level, look for users accessing known malicious domains or suspicious redirects to attacker-controlled content. Review logs for Chrome versions in your environment and identify unpatched instances for priority remediation.

Why prioritize this

The combination of network reachability, practical exploitability, and potential for data loss warrants rapid patching. While the sandbox limits direct OS compromise, the wealth of sensitive data accessible through a browser—email, SaaS applications, financial systems—makes this a credible threat to business operations and data confidentiality. The high CVSS score and the ease of delivery via web-based attack vectors place this in the top tier of browser vulnerabilities requiring urgent attention.

Risk score, explained

The 8.8 High severity CVSS score reflects the network attack vector (AV:N), low complexity (AC:L), no privilege requirement (PR:N), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). While user interaction is required (reducing exposure in some environments), the ease of manipulating users to click links, the ubiquity of Chrome, and the direct path to code execution justify the elevated score. The sandboxing mechanism provides some mitigation but does not reduce the CVSS rating because sandbox escapes and data theft within the sandbox are plausible follow-on impacts.

Frequently asked questions