CVE-2026-12455: Use-After-Free in Google Chrome Tab Strip—HIGH Severity Heap Corruption

Technical summary

CVE-2026-12455 is a use-after-free vulnerability (CWE-416) in the Tab Strip UI component of Google Chrome. The flaw occurs when the browser attempts to access memory that has already been freed, potentially allowing heap corruption. The vulnerability is triggered through a crafted HTML page combined with specific user interactions—the attacker must convince the user to engage in targeted UI gestures (e.g., tab manipulation) to trigger the freed memory access. The CVSS 3.1 score of 7.5 (HIGH) reflects the high impact to confidentiality, integrity, and availability, moderated by the requirement for user interaction and specific UI actions that make exploitation less straightforward than network-only attacks.

Business impact

This vulnerability poses a meaningful risk to organizations where employees browse untrusted content. Compromised Chrome instances could lead to data exfiltration, installation of malware, or lateral movement if the browser is used to access internal systems. The requirement for user interaction means targeted phishing or watering-hole attacks are the primary delivery mechanism. Organizations relying on Chrome as their primary browser, or those with users accessing sensitive applications through Chrome, should prioritize remediation to prevent potential data loss or credential theft.

Affected systems

Google Chrome versions prior to 149.0.7827.155 are vulnerable on all supported platforms: Windows, macOS, and Linux. Users on older Chrome versions, including extended release channels, are at risk if they have not auto-updated. The vulnerability does not affect other Chromium-based browsers unless they have independently incorporated the vulnerable code path, though vendors using Chromium as a base should review their own patch status.

Exploitability

Exploitation requires two conditions: (1) delivery of a crafted HTML page to the target user, and (2) convincing the user to perform specific UI interactions with the browser's tab strip. This is not a one-click attack—the attacker cannot trigger the vulnerability silently. However, the attack vector is network-based and does not require special privileges. Realistic attack scenarios include phishing emails with malicious links, compromised legitimate websites, or targeted watering-hole attacks against specific organizations. The Chromium security team has classified this as HIGH severity, indicating the potential for significant impact if user interaction barriers are overcome.

Remediation

Users and administrators should update Google Chrome to version 149.0.7827.155 or later as soon as possible. Chrome's auto-update mechanism should deploy the patch automatically, but users can manually check for updates via Help > About Google Chrome. Organizations using managed Chrome deployments should verify patch deployment through their Mobile Device Management (MDM) or endpoint management platform. There is no known workaround; updating is the only mitigation.

Patch guidance

Verify that Google Chrome has been updated to version 149.0.7827.155 or later by navigating to Help > About Google Chrome, which will show the installed version and auto-update if needed. For enterprise deployments, confirm patch deployment status through your MDM console or Chrome policy management system. Monitor Chrome update policies to ensure auto-updates are enabled unless your organization requires manual patch testing. Given the HIGH severity and network-accessible attack vector, this patch should be prioritized for rapid deployment, with a target of 7-14 days across all user populations.

Detection guidance

Monitor for unexpected Chrome process terminations or crashes related to tab operations, which may indicate exploitation attempts or successful exploitation. Network-based detection is limited since the attack vector is a crafted HTML page; focus on endpoint-level telemetry. Check browser history and recent tabs for suspicious sites users may have visited before Chrome crashes. If available, review Chrome's internal error reporting (if enabled) for use-after-free or heap corruption alerts. Note that successful exploitation may be silent and difficult to detect without memory forensics or behavioral monitoring. Security teams should assume that detection after-the-fact is unlikely and focus on prevention through patching and user awareness.

Why prioritize this

This vulnerability merits high-priority patching due to the combination of HIGH CVSS severity, network-accessible attack vector, and potential for significant data compromise. Although user interaction is required, the bar for exploitation is relatively low—social engineering or watering-hole attacks can reliably trigger the necessary actions. The ubiquity of Chrome in enterprise and personal use, combined with the difficulty of detecting successful exploitation, makes this a top candidate for rapid remediation. Organizations should treat this similarly to other HIGH-severity browser vulnerabilities that enable code execution or data theft.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH-severity vulnerability with significant impact potential. The score is driven by high ratings for confidentiality, integrity, and availability (all C:H, I:H, A:H), indicating successful exploitation could lead to data theft, malware installation, or service disruption. The score is moderated by Attack Complexity: High (AC:H), which accounts for the requirement for specific UI interactions and the unpredictability of user behavior. Network Accessibility (AV:N) and lack of privilege requirements (PR:N) elevate the threat model. No User Interaction modifier is applied, despite UI gestures being required, because the CVSS model classifies browser-based attacks differently—the crafted HTML page itself constitutes the attack, with user interaction being a normal part of browser use rather than an additional barrier.

Frequently asked questions