PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12449 Google CVE debrief

CVE-2026-12449 is a high-severity vulnerability in Google Chrome's Chromoting feature on Windows. It was reported on June 17, 2026, and modified on June 18, 2026. The vulnerability allows a local attacker to perform OS-level privilege escalation via a malicious file. The CVSS score for this vulnerability is 7.8, indicating a high level of severity. Users of Google Chrome on Windows should update to version 149.0.7827.155 or later to mitigate this vulnerability. [ref-4](https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html) provides details on the stable channel update. The issue was tracked internally as [ref-5](https://issues.chromium.org/issues/513480539).

Vendor
Google
Product
Chrome
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-18
Advisory published
2026-06-17
Advisory updated
2026-06-18

Who should care

Administrators and users of Google Chrome on Windows systems should be aware of this vulnerability. Local attackers could exploit this vulnerability to gain elevated privileges, potentially leading to further malicious activities.

Technical summary

The CVE-2026-12449 vulnerability is a use-after-free issue in the Chromoting feature of Google Chrome on Windows. This type of vulnerability occurs when a program uses memory after it has been freed, which can lead to unpredictable behavior. In this case, a local attacker can exploit the vulnerability by providing a malicious file, which could lead to OS-level privilege escalation. The CVSS vector for this vulnerability is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a high level of severity.

Defensive priority

High

Recommended defensive actions

  • Update Google Chrome to version 149.0.7827.155 or later.
  • Ensure that all users of Google Chrome on Windows systems are aware of this vulnerability and take steps to mitigate it.
  • Implement additional security measures, such as restricting access to sensitive areas of the system and monitoring for suspicious activity.
  • Consider implementing a defense-in-depth strategy to reduce the attack surface.
  • Regularly review and update software to ensure that all known vulnerabilities are patched.
  • Use secure coding practices to prevent similar vulnerabilities in the future.
  • Monitor system logs for signs of exploitation.

Evidence notes

The information provided is based on data from the NVD and CVE.org. The CVE record [cve-org] and NVD detail [nvd] pages provide additional information on this vulnerability. The source item [source-item] and references [ref-4], [ref-5] provide further context.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-12449 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-12449

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-12449 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-12449

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.