CVE-2026-12458: Chrome Password Feature Cross-Origin Data Leak (Low Severity)

Technical summary

CVE-2026-12458 stems from an improper implementation in Chrome's password handling mechanisms (CWE-451: User Interface Errors) that fails to properly enforce cross-origin isolation boundaries. An attacker can craft a malicious HTML page that, through carefully designed UI interactions, induces the browser to disclose data from a different origin. The flaw affects the confidentiality boundary but does not enable integrity compromise or service disruption. The CVSS 3.1 score of 3.1 (Low) reflects that exploitation requires both user interaction and high complexity (network-based delivery with user-gestures), yielding only limited information disclosure. The vulnerability impacts Chrome on Windows, macOS, and Linux systems.

Business impact

For most organizations, this vulnerability presents minimal immediate risk due to its low CVSS score and high exploitation barrier. However, targeted attacks against high-value employees—such as those in finance, legal, or executive roles—could potentially expose sensitive cross-site data if the victim is socially engineered to visit a malicious site while authenticated to sensitive services. The actual business impact depends on what data could be leaked in your specific ecosystem; for instance, if users regularly authenticate to financial portals and then visit untrusted sites, the risk increases. Patching should be routine and not require emergency response procedures, but it should still be prioritized within standard update cycles.

Affected systems

Google Chrome browsers running versions prior to 149.0.7827.155 on Windows, macOS, and Linux are affected. This includes all platforms where Chrome is deployed. Enterprise users leveraging managed Chrome deployments, educational institutions with Chrome-based fleets, and individual users who have not auto-updated are all in scope. The vulnerability does not affect other browsers (Firefox, Safari, Edge, etc.) unless they share the underlying Chromium code, which some do; verify your specific browser inventory.

Exploitability

Exploitation is not trivial. An attacker must convince a user to visit a crafted webpage and then perform specific UI interactions—such as mouse clicks, keyboard input, or scrolling—at precise moments. The attacker cannot remotely trigger the data leak without user action. No known public exploits or active exploitation have been reported in the wild at the time of publication (not listed on the CISA Known Exploited Vulnerabilities catalog). The attack surface is primarily limited to socially-engineered distribution of malicious links, making widespread automated exploitation unlikely.

Remediation

Update Google Chrome to version 149.0.7827.155 or later. For Chrome on Windows, macOS, and Linux, updates typically roll out automatically; users can manually check via Help > About Google Chrome, which will prompt immediate download and installation if a newer version is available. Organizations managing Chrome through group policy or mobile device management (MDM) solutions should verify that their update policies are configured to push version 149.0.7827.155 or newer. No workarounds exist; patching is the only remediation.

Patch guidance

Verify that all instances of Google Chrome within your environment have reached version 149.0.7827.155 or higher. For enterprise deployments: (1) confirm your update infrastructure (Cloud Management Console, group policy, MDM platform) is configured to deliver the patched version; (2) establish a verification baseline by scanning deployed instances or reviewing update logs; (3) prioritize unmanaged or personal devices by communicating patch urgency to end users. Desktop browser versions should be checked via the About menu; mobile devices running Chrome should be verified in their respective app stores or device management console. Given the low CVSS score, a standard 30-day patching window is acceptable unless your risk profile demands faster deployment.

Detection guidance

Detection of active exploitation is challenging because the attack relies on normal browser interaction with a crafted webpage and would leave minimal forensic trace. Monitor for: (1) unexpected user reports of data leakage or unauthorized access to accounts after visiting unfamiliar websites; (2) indicators of compromise in web application logs showing unusual cross-origin data access patterns from single user sessions; (3) user browsing telemetry (via endpoint detection and response tools or browser telemetry) that correlates visits to suspicious domains with subsequent data-access anomalies. Most effectively, prevent exploitation by ensuring Chrome is up-to-date and combining patch management with user security awareness training on social engineering and untrusted link clicking.

Why prioritize this

This vulnerability merits standard-priority remediation, not emergency response. Although Chromium's internal severity is rated High, the CVSS 3.1 score of 3.1 (Low) reflects real exploitation barriers: high attack complexity, mandatory user interaction, and limited information disclosure scope. The absence from the CISA KEV catalog further supports that real-world exploitation has not been observed at scale. Prioritize this within your regular browser patch cycles (typically monthly), but do not delay other critical patching or consume emergency response resources.

Risk score, explained

The CVSS 3.1 score of 3.1 (Low, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects: (1) Network attack vector (AV:N)—attacker can deliver the malicious page remotely; (2) High attack complexity (AC:H)—exploitation demands precise UI interaction and unusual browser conditions; (3) No privileges required (PR:N); (4) Required user interaction (UI:R)—user must engage with the page; (5) Unchanged scope (S:U)—impact is limited to the vulnerable component itself; (6) Low confidentiality impact (C:L)—some data may leak, but not all user secrets; (7) No integrity or availability impact (I:N, A:N). The gap between Chromium's High severity designation and CVSS's Low score exists because CVSS penalizes exploitation barriers that Chromium's internal metric may weight differently; both assessments are valid and inform different aspects of risk.

Frequently asked questions