CVE-2026-12449: Chrome Chromoting Use-After-Free Privilege Escalation

Technical summary

CVE-2026-12449 is a use-after-free memory vulnerability (CWE-416) in the Chromoting subsystem of Google Chrome for Windows. Use-after-free flaws occur when an application references memory that has been deallocated, potentially allowing attackers to execute arbitrary code or escalate privileges. In this case, the vulnerability permits local privilege escalation from user context to system-level access when a malicious file is processed by Chrome. The vulnerability has been assigned a CVSS 3.1 score of 7.8 (High severity) with a local attack vector and user interaction requirement.

Business impact

A successful exploit of this vulnerability could enable an attacker with local system access to gain administrative control, leading to potential data exfiltration, malware installation, lateral movement within a network, or complete system compromise. For organizations running Chrome on Windows workstations, this represents a significant risk to endpoint security and could facilitate advanced persistent threats if attackers first gain initial local access through other means.

Affected systems

This vulnerability affects Google Chrome on Microsoft Windows systems running versions prior to 149.0.7827.155. The flaw is specific to the Chromoting remote desktop feature in Chrome's Windows implementation and does not affect other operating systems or non-Chromoting code paths. Organizations with Chrome deployments on Windows are in scope; Mac and Linux users are not affected.

Exploitability

While the vulnerability requires local system access and user interaction (opening a malicious file), these are not high barriers in many enterprise environments. Users regularly receive files via email, file shares, or downloads that could potentially be weaponized. The attack does not require administrator privileges to initiate, and a local attacker with ordinary user rights can exploit it. However, it is not remotely exploitable and does not target unauthenticated network services, which moderates the overall risk profile.

Remediation

Organizations should upgrade Google Chrome on Windows systems to version 149.0.7827.155 or later as soon as practical. Verify the specific patch version against Google's official Chrome release notes and security advisory to ensure accurate deployment. Automated update mechanisms in Chrome should be enabled where possible to minimize manual patching overhead.

Patch guidance

Deploy Google Chrome version 149.0.7827.155 or newer across Windows endpoints. Chrome typically auto-updates, but verify that auto-update is enabled in your environment and monitor update completion. For managed deployments using Group Policy or mobile device management (MDM) solutions, push the minimum patched version to ensure compliance. Test the patch in a non-production environment first to rule out compatibility issues with internal web applications or extensions, though this update should pose minimal compatibility risk.

Detection guidance

Monitor for suspicious file access patterns within the Chromoting process that may indicate exploitation attempts. Look for anomalous privilege escalation events following Chrome activity, particularly when Chrome opens untrusted or unexpected files. Review Windows Event Viewer for unexpected elevation of privilege events (Event ID 4688 with privilege escalation indicators) following Chrome user sessions. Security monitoring tools that track process behavior and memory access anomalies may detect the use-after-free condition during active exploitation attempts.

Why prioritize this

This vulnerability merits high priority remediation because it enables local privilege escalation with moderate user interaction requirements. The local attack vector and privilege escalation path make it valuable to attackers seeking to escalate from initial compromise to system administrator control. While not currently flagged as actively exploited in the wild (KEV status is false), the combination of High CVSS score and real-world escalation capability warrants prompt patching, particularly in security-sensitive environments.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a High severity rating driven by the confluence of local attack vector, lack of privilege requirements, user interaction trigger, and the severe impact: high confidentiality, integrity, and availability compromise. The score appropriately weights the practical limitation that local access is required (rather than network-based) but acknowledges that privilege escalation flaws are commonly chained with other vulnerabilities in real attacks. The user interaction requirement (opening a file) is the primary mitigating factor preventing a Critical rating.

Frequently asked questions