CVE-2026-12463: Chrome Linux UXSS via Renderer Compromise

Technical summary

CVE-2026-12463 is a Cross-Site Scripting (XSS) vulnerability classified as Universal XSS (UXSS) due to its ability to bypass same-origin policy restrictions. It stems from an inappropriate implementation in the Views subsystem of Chromium on Linux. The vulnerability requires that an attacker has already achieved code execution within the renderer process, then uses a specially crafted HTML page to inject arbitrary scripts or HTML. This represents a privilege escalation scenario rather than a direct remote code execution vector, since renderer process compromise is a prerequisite. The Chromium security team assessed this as High severity at the component level.

Business impact

While the CVSS score of 4.7 reflects a medium severity rating, the business impact depends on your threat model. If your organization uses Chrome on Linux for sensitive work, and if renderer process exploits are known or suspected in your threat landscape, this vulnerability could allow attackers to steal session tokens, perform actions on behalf of users, or deface content. The requirement for prior renderer compromise means this is typically chained with other vulnerabilities. Organizations running unpatched Linux systems with public-facing Chrome instances should prioritize patching. For most enterprise desktop environments, the risk is lower unless renderer exploits are actively being weaponized.

Affected systems

Google Chrome on Linux systems running versions prior to 149.0.7827.155 are affected. The vulnerability is specific to the Linux platform and does not impact Chrome on Windows or macOS according to the advisory. The Linux kernel itself is listed in affected products, but this appears to be a classification artifact; the vulnerability is in Chrome's Views implementation, not the kernel. Verify your Chrome version and Linux distribution support status before applying patches.

Exploitability

Exploitability is constrained by multiple factors. An attacker must first compromise the Chrome renderer process—a non-trivial prerequisite typically requiring a separate renderer exploit (such as a memory safety bug). Once renderer access is obtained, the attacker crafts a malicious HTML page that the compromised renderer will parse and interpret. The attack requires user interaction in the form of browsing to the malicious page (reflected in the CVSS User Interaction requirement). The vulnerability is not known to be publicly exploited; it does not appear on CISA's Known Exploited Vulnerabilities catalog. In practice, this is a secondary exploitation step in a multi-stage attack chain.

Remediation

Update Google Chrome on Linux to version 149.0.7827.155 or later. Verify the update through Chrome's About page (chrome://about or Help > About Google Chrome), which will display the current version and automatically check for updates. For managed environments, deploy the update via your standard patch management process. Since the vulnerability requires prior renderer compromise, applying this patch closes one attack vector but does not eliminate the need for defense-in-depth measures such as renderer sandboxing, content security policies, and monitoring for renderer process exploits.

Patch guidance

Chrome on Linux will auto-update to version 149.0.7827.155 or newer. Users can manually check for updates in chrome://settings/help. For enterprise deployments, administrators can configure automatic update policies via group policy or machine-level configuration depending on your Linux distribution and deployment method. Verify patch application by checking chrome://version. No compatibility issues or known regressions have been reported for this update. If you manage Chrome fleet-wide, prioritize systems that handle sensitive data or are exposed to untrusted content.

Detection guidance

Monitor Chrome process behavior for signs of renderer process compromise, such as unexpected child processes, unusual memory access patterns, or suspicious system calls from the renderer sandbox. Log and alert on Chrome crashes, particularly renderer process crashes followed by successful navigation to external content—this pattern may indicate exploitation attempts. Network-based detection is limited; focus on endpoint telemetry and process monitoring. If you have access to renderer process audit logs or browser history, look for navigation to suspicious domains immediately preceding crashes or security warnings. Detection of the injection itself is challenging without access to the renderer's internal DOM state; focus instead on detecting the prior renderer compromise.

Why prioritize this

Prioritize this vulnerability as medium-to-high for Linux-based Chrome deployments, particularly if renderer exploits are observed in your threat intelligence. The secondary nature of the attack (requiring prior renderer compromise) lowers the immediate priority compared to primary remote code execution vulnerabilities, but the UXSS capability is dangerous if an attacker gains renderer access. Patch within 30 days as part of routine Chromium updates. Organizations running Chrome on Linux in high-trust environments or handling sensitive data should patch sooner.

Risk score, explained

The CVSS 3.1 score of 4.7 (Medium) reflects several mitigating factors: the attack requires prior renderer process compromise (increasing Attack Complexity), user interaction is needed (the user must visit a malicious page), and the impact is limited to confidentiality and integrity rather than full system compromise. However, the score may underrepresent risk in scenarios where renderer exploits are known to be in circulation. The score does not account for the chaining of this vulnerability with other exploits. For your risk assessment, treat this as elevated if renderer exploits are part of your threat model.

Frequently asked questions