PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12451 Google CVE debrief

CVE-2026-12451 is a high-severity vulnerability in Google Chrome's DigitalCredentials component. A remote attacker who has compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page. The vulnerability has a CVSS score of 8.3 and was published on 2026-06-17. Users of Google Chrome prior to version 149.0.7827.155 are affected. The CVE was modified on 2026-06-18 to reflect additional information. Chromium security rates this issue as High severity. To mitigate, users should update Google Chrome to version 149.0.7827.155 or later.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-18
Advisory published
2026-06-17
Advisory updated
2026-06-18

Who should care

This vulnerability affects users of Google Chrome, particularly those who browse the web and may encounter crafted HTML pages. Organizations that use Google Chrome in their environments should prioritize patching to prevent potential sandbox escapes.

Technical summary

The vulnerability is a use after free issue in the DigitalCredentials component of Google Chrome. This occurs when the browser's memory management system improperly handles memory after it has been freed, allowing an attacker to potentially execute arbitrary code. The issue is rated as High severity by Chromium and has a CVSS score of 8.3. The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating a network attack vector with high complexity and no privileges required.

Defensive priority

High

Recommended defensive actions

  • Update Google Chrome to version 149.0.7827.155 or later
  • Ensure all users of Google Chrome in the organization are updated to the latest version
  • Monitor Google Chrome for any suspicious activity or potential sandbox escapes
  • Implement additional security measures such as sandboxing and isolation
  • Regularly review and update browser extensions and plugins
  • Use a web application firewall to detect and prevent potential attacks
  • Educate users on safe browsing practices and the importance of keeping software up-to-date

Evidence notes

The information provided is based on the official CVE record and NVD details. The CVE was published on 2026-06-17 and modified on 2026-06-18. The vulnerability is rated as High severity by Chromium and has a CVSS score of 8.3.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-12451 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-12451

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-12451 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-12451

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.