CVE-2026-12467: Chrome Use-After-Free Sandbox Escape (v149.0.7827.155)

Technical summary

This vulnerability is a use-after-free (CWE-416) in Chrome's Extensions implementation. Use-after-free occurs when code attempts to access memory that has been freed, leading to unpredictable behavior and potential code execution. In this case, the flaw exists in how Chrome manages extension-related objects in memory. An attacker with renderer process compromise can craft a webpage that triggers dereferencing of freed memory, corrupting the sandbox boundary. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C) reflects network-accessible attack requiring high complexity, user interaction, and cross-boundary scope changes. The HIGH Chromium severity rating aligns with the sandbox-escape capability.

Business impact

Sandbox escapes in Chrome elevate the risk profile significantly for any organization relying on browser isolation as a security control. While the vulnerability requires prior renderer compromise, successful exploitation allows an attacker to move from sandbox confinement to unrestricted system access, potentially enabling data theft, malware installation, or lateral movement. Organizations using Chrome in security-sensitive roles (secure browsing terminals, isolated research environments) should treat this as a priority. General enterprise users face moderate risk unless exposed to targeted attacks combining multiple exploits.

Affected systems

The vulnerability affects Google Chrome on multiple platforms: Windows, macOS, and Linux systems running Chrome versions prior to 149.0.7827.155. The vendor/product list references Windows, macOS, Linux kernel, and Chrome itself; this indicates the flaw is platform-agnostic and affects Chrome on all major operating systems. Any user or system running an unpatched Chrome version before 149.0.7827.155 is at risk.

Exploitability

Exploitation requires two preconditions: (1) the attacker must first compromise the Chrome renderer process through another vulnerability or attack vector, and (2) the user must visit or be directed to a crafted HTML page. The Attack Complexity is rated HIGH, reflecting the need for renderer compromise as a prerequisite. There is no public exploit available in CISA's Known Exploited Vulnerabilities catalog, and the kev status is false. However, the sandbox-escape nature of the flaw makes it highly valuable to advanced threat actors, and we should expect proof-of-concept development following the patch release.

Remediation

Update Google Chrome to version 149.0.7827.155 or later immediately. Chrome's auto-update mechanism should deploy this version automatically, but users should verify their installed version against the requirements. Organizations with managed Chrome deployments (via enterprise policies) should confirm rollout completion. No workarounds exist; patching is the only mitigation. Users unable to patch immediately should avoid opening untrusted or unexpected links and consider disabling extensions that are not essential.

Patch guidance

Verify your Chrome version by navigating to chrome://settings/help, which displays the installed version and initiates an auto-update check. Patch availability targets version 149.0.7827.155 or later. Enterprise administrators should use Google's Admin console to force deployment across managed devices, tracking rollout status through the policy dashboard. For automated patch verification, query Chrome's user-agent string or inspect the executable properties on Windows/macOS/Linux systems. Allow 24–48 hours for full propagation across auto-update infrastructure before assuming all users are patched.

Detection guidance

Monitor Chrome version inventory across your environment using your endpoint detection and response (EDR) or mobile device management (MDM) platform. Flag systems running Chrome versions below 149.0.7827.155. Check for suspicious extension behavior (unexpected installation, permission escalation, network communication to unknown hosts) using Chrome enterprise logs or browser history analysis. Network-level detection is difficult because exploitation occurs post-compromise and within the browser process, but monitor for unusual process spawning from Chrome or renderer processes that attempt system-level operations. Log extensions installed system-wide and compare against your organization's approved extension list.

Why prioritize this

This vulnerability merits high priority because it is a sandbox escape—the most dangerous class of browser vulnerability—affecting a widely-used browser on all major platforms. Although it requires prior renderer compromise, the impact (full system access) and the broad Chrome user base make it a critical risk. The CVSS 8.3 score and Chromium HIGH severity rating reflect the severity. Prioritize patching over the next 48–72 hours, with particular urgency for systems used in sensitive roles or exposed to advanced adversaries.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) accurately reflects the severity. The Attack Vector (Network) and Scope (Changed) indicate broad reachability and boundary violation. Attack Complexity (High) and User Interaction (Required) lower the score from Critical, recognizing that renderer compromise is a prerequisite. However, Confidentiality, Integrity, and Availability impacts are all High, confirming that successful exploitation grants complete system compromise. The score appropriately weighs the exceptional nature of the flaw (sandbox escape) against its real-world complexity.

Frequently asked questions