Google Chrome fixes 33 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Google Chrome fixes 33 vulnerabilities

Google fixes 33 vulnerabilities in Google Chrome and in other Chromium-based web browsers. Google fixed the vulnerabilities in version 149.0.7827.155 for Chrome on Linux and in version 149.0.7827.155/156 for Chrome on Windows/Mac. Selected vulnerabilities are described below; the remaining ones can be found at [1].

Google Chrome - use after free (CVE-2026-12439, CVE-2026-12441, CVE-2026-12442, CVE-2026-12443)

CVSS 8.8 (High)

Allows an unauthenticated remote attacker to exploit a pointer to already freed memory by means of a specially crafted HTML page, which may lead to memory corruption and potentially to code execution [1].

The vulnerability is present in products:

Windows:Google Chrome; <149.0.7827.156
macOS:Google Chrome; <149.0.7827.156
Linux:Google Chrome; <149.0.7827.155

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

CVE-2026-12439 at cve.org, NVD
CVE-2026-12441 at cve.org, NVD
CVE-2026-12442 at cve.org, NVD
CVE-2026-12443 at cve.org, NVD
CWE-416: Use After Free at cwe.mitre.org

The vulnerability was publicly disclosed 16. 6. 2026.

Google Chrome - use after free (CVE-2026-12437, CVE-2026-12440)

CVSS 8.3 (High)

Allows an unauthenticated remote attacker who has already compromised the renderer process to exploit a pointer to already freed memory and escape the browser sandbox by means of a specially crafted HTML page [1].

The vulnerability is present in products:

Windows:Google Chrome; <149.0.7827.156
macOS:Google Chrome; <149.0.7827.156
Linux:Google Chrome; <149.0.7827.155

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

CVE-2026-12437 at cve.org, NVD
CVE-2026-12440 at cve.org, NVD
CWE-416: Use After Free at cwe.mitre.org

The vulnerability was publicly disclosed 16. 6. 2026.

Google Chrome - sandbox escape (CVE-2026-12438)

CVSS 8.3 (High)

Allows an unauthenticated remote attacker who has already compromised the renderer process to escape the browser sandbox by means of a specially crafted HTML page, due to an incorrect implementation of the WebView component [1].

The vulnerability is present in products:

Windows:Google Chrome; <149.0.7827.156
macOS:Google Chrome; <149.0.7827.156
Linux:Google Chrome; <149.0.7827.155

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

CVE-2026-12438 at cve.org, NVD
CWE-693: Protection Mechanism Failure at cwe.mitre.org

The vulnerability was publicly disclosed 16. 6. 2026.

Report feedback

[TLP:CLEAR] Google Chrome fixes 33 vulnerabilities

Google Chrome - use after free (CVE-2026-12439, CVE-2026-12441, CVE-2026-12442, CVE-2026-12443)

CVSS 8.8 (High)

Google Chrome - use after free (CVE-2026-12437, CVE-2026-12440)

CVSS 8.3 (High)

Google Chrome - sandbox escape (CVE-2026-12438)

CVSS 8.3 (High)

Links