CVE-2026-12452: Chrome Android Use-After-Free in Downloads (CVSS 8.8)

Technical summary

CVE-2026-12452 is a use-after-free vulnerability (CWE-416) in the Downloads subsystem of Google Chrome on Android. The flaw permits a remote, unauthenticated attacker to trigger heap corruption through a specially crafted HTML page delivered over the network. The vulnerability requires user interaction (visiting the malicious page) but no additional privileges. Successful exploitation can lead to arbitrary code execution within the Chrome process context. Google classified this as High severity in the Chromium security taxonomy; the CVSS 3.1 score of 8.8 reflects the network attack vector, low complexity, high impact to confidentiality, integrity, and availability, and the requirement for user interaction.

Business impact

Mobile-first organizations and enterprises with significant Android user bases face operational risk if employees use Chrome as their primary browser. A successful exploit could lead to unauthorized access to user credentials, corporate email, cloud service tokens, and sensitive documents cached in the browser. The attack surface is particularly broad because it requires only that users visit a compromised or attacker-controlled website—no direct social engineering or credential phishing is necessary. Organizations should prioritize patching to prevent potential lateral movement from compromised mobile devices to corporate networks.

Affected systems

The vulnerability affects Google Chrome on Android devices running versions prior to 149.0.7827.155. Desktop versions of Chrome are not affected by this Downloads-specific Android flaw. Users of other Chromium-based browsers on Android (Edge, Opera, Brave, etc.) should verify with those vendors whether they have backported the fix or remain vulnerable. Android 5.0 and later are potentially affected, as Chrome for Android supports those versions, though the specific Android OS version does not factor into exploitability.

Exploitability

This vulnerability has a moderate-to-high exploitability barrier in practical terms: an attacker must craft a malicious HTML page and convince or trick users into visiting it—either through social engineering, ad networks, compromised legitimate websites, or network-level redirection. Once a user lands on the page, the vulnerability triggers automatically without further interaction. There is no publicly disclosed proof-of-concept code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active in-the-wild exploitation has not been confirmed at publication time. However, the simplicity of the attack (crafted HTML) and low barrier to delivery via web make it an attractive target for sophisticated threat actors once patches begin rolling out slowly.

Remediation

Update Google Chrome on all Android devices to version 149.0.7827.155 or later immediately. Enable automatic updates in Chrome settings (Settings > About Chrome) to receive patches as soon as Google releases them. For enterprise environments, deploy Chrome updates via Mobile Device Management (MDM) solutions such as Google Mobile Management, Microsoft Intune, or Jamf to enforce compliance. Verify that auto-update policies are not disabled by device profiles or network policies.

Patch guidance

Google released the fix in Chrome version 149.0.7827.155 for Android. Users can check their current Chrome version in Settings > About Chrome, which will automatically check for updates and prompt installation. Enterprise administrators should verify MDM policies allow Chrome auto-update or manually deploy the patched version through their mobile app management platform. Test patch deployment in a pilot group before rolling out organization-wide to confirm no critical functionality is affected. Verify the update completes and Chrome version displays as 149.0.7827.155 or higher after restart.

Detection guidance

Monitor for unusual Chrome process crashes or restarts on Android devices, which may indicate exploitation attempts. In network security monitoring, look for unusual traffic patterns to or from known malicious domains on port 443 (HTTPS), as the attack requires the user's device to connect to the attacker's server. On endpoints with logging enabled, check Chrome's user data directory (typically /data/data/com.android.chrome/) for unexpected or modified files. Implement app-based threat detection using mobile security tools that monitor for heap corruption attempts or anomalous Chrome behavior. Enable SafeBrowsing in Chrome settings to detect visits to known malicious pages.

Why prioritize this

Patch this vulnerability urgently. The combination of network-based attack delivery, automatic trigger (no user interaction beyond visiting a page), high-severity CVSS score (8.8), and potential for code execution make this a top-tier priority for mobile-heavy organizations. While not yet in active widespread exploitation, the simplicity of delivery and lack of user complexity create a low barrier for attackers. The Downloads feature is frequently used, increasing exposure. Mobile devices often hold credentials and tokens for email, cloud services, and corporate applications, making compromise particularly damaging.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network Attack Vector (AV:N)—exploitable remotely without special access; (2) Low Attack Complexity (AC:L)—no special conditions or advanced techniques needed; (3) No Privileges Required (PR:N)—attacker needs no prior system access; (4) Required User Interaction (UI:R)—user must visit the malicious page, preventing fully autonomous propagation; (5) Unchanged Scope (S:U)—impact limited to the Chrome process; (6) High Confidentiality Impact (C:H)—potential access to cached credentials and data; (7) High Integrity Impact (I:H)—code execution allows modification of user data; (8) High Availability Impact (A:H)—exploitation can crash or disable Chrome. The High severity designation is appropriate for a memory corruption flaw with code execution potential on a ubiquitous mobile browser.

Frequently asked questions