Description
Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-06-11
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw in the Core component of Google Chrome on Windows allows a remote attacker to run arbitrary code by delivering a specially crafted HTML page. The vulnerability is classified as Critical by Chromium, indicating that exploitation could compromise confidentiality, integrity, and availability of the affected system.

Affected Systems

Google Chrome for Windows versions prior to 149.0.7827.115 are affected. Updating to 149.0.7827.115 or a later release removes the flaw.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, and the classification as Critical by Chromium reinforces the risk. The EPSS score of 0.00286 (about 0.29%) indicates a very low yet non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, yet the nature of the flaw would still enable an attacker with control over a web page to execute code on the victim machine.

Generated by OpenCVE AI on June 19, 2026 at 13:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch: upgrade Chrome to 149.0.7827.115 or newer.
  • Enable or enforce Chrome’s Site Isolation and sandbox features to reduce the impact of memory‑corruption bugs such as use‑after‑free vulnerabilities.
  • Restrict execution of JavaScript and plugins from untrusted sites; consider using a content‑security policy or disabling extensions that may interact with webpage content.

Generated by OpenCVE AI on June 19, 2026 at 13:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6344-1 chromium security update
History

Fri, 19 Jun 2026 18:15:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome Core Enables Remote Code Execution via Crafted HTML Page

Fri, 19 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 12 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows

Fri, 12 Jun 2026 03:45:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Core Enabling Remote Code Execution on Windows

Fri, 12 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 12 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Core Enabling Remote Code Execution on Windows

Thu, 11 Jun 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 11 Jun 2026 21:30:00 +0000

Type Values Removed Values Added
Description Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-12T03:55:57.347Z

Reserved: 2026-06-11T18:16:02.135Z

Link: CVE-2026-12007

cve-icon Vulnrichment

Updated: 2026-06-12T01:10:24.129Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-11T22:16:52.117

Modified: 2026-06-12T17:08:00.423

Link: CVE-2026-12007

cve-icon Redhat

Severity : Important

Publid Date: 2026-06-11T20:48:04Z

Links: CVE-2026-12007 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-19T14:00:16Z

Weaknesses