PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12013 Google CVE debrief

CVE-2026-12013 is a high-severity vulnerability in Google Chrome on Windows, allowing remote attackers to potentially exploit heap corruption via a crafted HTML page. The vulnerability is caused by a use-after-free issue in the Media component.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-11
Original CVE updated
2026-06-12
Advisory published
2026-06-11
Advisory updated
2026-06-12

Who should care

Users of Google Chrome on Windows, particularly those who browse the internet and may be exposed to crafted HTML pages.

Technical summary

The vulnerability is caused by a use-after-free issue in the Media component of Google Chrome on Windows. This allows remote attackers to potentially exploit heap corruption via a crafted HTML page. The CVSS score for this vulnerability is 8.8, indicating a high severity.

Defensive priority

High

Recommended defensive actions

  • Update Google Chrome to version 149.0.7827.115 or later.
  • Refer to [ref-4](https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html) for more information on the stable channel update for desktop.

Evidence notes

The vulnerability was reported by an anonymous researcher and is tracked as issue [ref-5](https://issues.chromium.org/issues/514229805).

Official resources

CVE-2026-12013 was published on [cvePublishedAt] and modified on [cveModifiedAt].