CVE-2026-12459: Google Chrome Serial Component XSS Vulnerability (Version 149.0.7827.155)

Technical summary

CVE-2026-12459 is a Cross-Site Scripting (CWE-79) vulnerability stemming from inappropriate implementation in Chrome's Serial component. The flaw permits Unfiltered User-Supplied Input XSS (UXSS), enabling arbitrary script and HTML injection via crafted HTML payloads. The vulnerability affects Chrome on Windows, macOS, and Linux systems. With a CVSS 3.1 score of 6.1 (MEDIUM), the attack vector is network-based, requires low complexity, no privileges, but does require user interaction. The scope is changed, indicating the vulnerability can affect resources beyond the vulnerable component itself.

Business impact

Organizations deploying Chrome across their workforce face elevated risk of session hijacking, credential theft, and malware distribution if users visit attacker-controlled or compromised websites. The requirement for user interaction reduces mass-exploitation scenarios, but phishing campaigns or watering-hole attacks targeting enterprise employees remain credible threats. Data confidentiality and integrity are at moderate risk; system availability is not impacted. Delayed patching extends the window for opportunistic exploitation by threat actors.

Affected systems

Google Chrome versions earlier than 149.0.7827.155 are vulnerable on all major operating systems: Windows, macOS, and Linux. The vulnerability exists in the Serial component, which handles web-based serial port communication. Users running Chrome version 149.0.7827.155 or later are not affected. Enterprises should inventory Chrome installations across their estate and cross-reference against the fixed version.

Exploitability

Exploitation is straightforward from an attacker perspective: a crafted HTML page served via HTTP or embedded in email/messaging platforms can trigger the vulnerability when a user visits or interacts with it. No authentication, elevated privileges, or complex exploitation chains are required. However, the user interaction requirement prevents purely passive exploitation vectors like drive-by downloads. The Chromium project did not add this to the Known Exploited Vulnerabilities catalog as of the publication date, but exploitation complexity remains low enough that proactive patching is justified.

Remediation

Update Google Chrome to version 149.0.7827.155 or later on all affected systems. Chrome's automatic update mechanism typically deploys patches within hours to days of release; verify update completion through chrome://version. For managed enterprise environments, use group policies or mobile device management to enforce minimum version requirements. Organizations with restricted auto-update settings should prioritize manual verification and deployment of the patch.

Patch guidance

Ensure Chrome is updated to 149.0.7827.155 or later. In enterprise settings, verify via the "About Chrome" menu or programmatically query installed versions. If auto-update is disabled, manually trigger updates through Settings > About Chrome. For macOS users, confirm that the application is running the patched version after installation. Linux users should verify their distribution's package repository offers the patched version, or use Chrome's official repositories. Test patch deployment in a small cohort before full rollout to confirm no compatibility issues with internal web applications.

Detection guidance

Monitor Chrome version compliance across your organization; versions below 149.0.7827.155 are vulnerable. Detect potential exploitation attempts by logging access to suspicious or malicious HTML pages if web content filtering is in place. Web Application Firewalls and email gateways can flag emails containing links to known attacker domains. Within Chrome itself, enable Safe Browsing features (enabled by default) to warn users of suspicious sites. Post-breach, analyze browser history on affected machines for visits to malicious domains or unusual script injection patterns in web server logs.

Why prioritize this

Although the CVSS score is MEDIUM (6.1) and the vulnerability requires user interaction, the low exploitation complexity, widespread Chrome deployment, and prevalence of phishing/watering-hole tactics justify prompt patching. The change-of-scope nature of the vulnerability means injected scripts can impact more than the immediate page context. Organizations should prioritize this update within their standard 30-day patch cycle, ahead of lower-severity issues, particularly if users frequently visit untrusted sites or receive targeted phishing campaigns.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a network-accessible vulnerability with low attack complexity and no privilege requirements, balanced against the user interaction prerequisite and limited impact scope (confidentiality and integrity, but not availability). The score does not account for contextual factors such as the rarity of active exploitation, the speed of Chrome's patching cycle, or the sensitive nature of serialized data accessed via the Serial API in web contexts. Organizations should consider raising their internal priority if Chrome users handle sensitive tasks or if phishing attacks are prevalent in their threat model.

Frequently asked questions