CVE-2026-12451: Chrome DigitalCredentials Use-After-Free Sandbox Escape (CVSS 8.3)

Technical summary

CVE-2026-12451 is a use-after-free vulnerability (CWE-416) in Chrome's DigitalCredentials subsystem. The vulnerability exists in memory management within the renderer process; specifically, code references a memory object after it has been freed, creating a window for exploitation. When combined with a compromised renderer process—which an attacker might achieve through a separate browser vulnerability or social engineering—this use-after-free can be exploited via crafted HTML to achieve sandbox escape. The escape allows code execution at the privilege level of the Chrome process, bypassing the renderer sandbox that normally isolates web content from system resources.

Business impact

This vulnerability is significant because it represents a complete compromise chain: renderer compromise leads directly to sandbox escape and full system code execution. For organizations relying on Chrome's sandbox as a security boundary between untrusted web content and sensitive operations, successful exploitation could lead to theft of credentials, lateral movement to network resources, installation of persistent malware, or data exfiltration. The impact is elevated for enterprises that permit high-risk web browsing or use Chrome for sensitive tasks.

Affected systems

Google Chrome versions prior to 149.0.7827.155 are directly affected. The vulnerability impacts Chrome across all major operating systems: Windows, macOS, and Linux, as well as Chromium-based derivatives. Any organization or end-user running an outdated version of Chrome is at risk. Note that the vulnerability requires successful renderer compromise as a prerequisite, which somewhat limits immediate exposure compared to a direct sandbox-escape bug.

Exploitability

Practical exploitation requires two conditions: (1) successful compromise of the Chrome renderer process through a separate vulnerability or attack vector, and (2) user interaction to load a specially crafted HTML page. The CVSS vector reflects these constraints with AC:H (high attack complexity) and UI:R (user interaction required). While the attack chain has dependencies, the use-after-free itself is a well-understood memory safety class that can often be reliably triggered once renderer code execution is achieved. Active exploitation in the wild is not confirmed in available threat intelligence (KEV status is not listed), but the high CVSS score and Chromium severity assessment indicate this poses a material risk to defense-in-depth strategies.

Remediation

Update Google Chrome to version 149.0.7827.155 or later immediately. This patch version addresses the use-after-free condition in DigitalCredentials. Users should enable automatic updates to receive the patch without manual intervention. For enterprise environments, Chrome updates can be managed through Group Policy (Windows), managed settings (macOS), or enterprise mobile device management (MDM) platforms.

Patch guidance

Deploy Chrome version 149.0.7827.155 or later across your organization. Verify successful patch deployment by checking Chrome's About > Chrome version screen (which will indicate 'You're up to date' once patched). For automated deployment: Windows administrators can use Group Policy to enforce Chrome updates; macOS environments can use management profiles; Linux systems should use their distribution's package manager or Chrome's auto-update service. Test the patch in a limited environment first if your organization uses extensions or custom configurations that might be affected.

Detection guidance

Monitor for Chrome process crashes or abnormal memory access patterns that might indicate attempted exploitation. Log browser version information across your fleet to identify machines still running versions prior to 149.0.7827.155. Endpoint detection and response (EDR) tools should flag suspicious behavior in Chrome renderer processes (chrome.exe with unusual child process spawning or elevated privilege acquisition). Network intrusion detection should identify attempts to serve malicious HTML payloads known to trigger this vulnerability, though signatures would need custom development. User awareness training remains important to reduce renderer-compromise attack surface.

Why prioritize this

This vulnerability merits high priority deployment due to its CVSS 8.3 severity, complete compromise potential (sandbox escape), and broad platform impact. Although exploitation requires prior renderer compromise, the combination of use-after-free reliability and sandbox escape functionality creates a dangerous escalation path. Organizations using Chrome for sensitive tasks or in environments with sophisticated threat actors should prioritize this patch within days rather than weeks. The absence of KEV listing and active exploitation does not diminish priority, as sophisticated attackers may be silently stockpiling this capability.

Risk score, explained

The CVSS 8.3 HIGH score reflects: (1) High impact across confidentiality, integrity, and availability (C:H/I:H/A:H), (2) Network vector (AV:N) allowing remote exploitation, (3) Moderate attack complexity (AC:H) and user interaction (UI:R) as practical constraints. The score appropriately weights the severity of sandbox escape against the prerequisite of renderer compromise. The scope-changed component (S:C) indicates that successful exploitation affects security domains beyond the vulnerable component, justifying the high severity.

Frequently asked questions