Critical Chrome Vulnerabilities Allow Attackers to Execute Arbitrary Code

EXECUTIVE SUMMARY:

CVE-2026-12437 – Use-After-Free in WebShare[emaillocker id="1283"]

A use-after-free vulnerability exists in Chrome's WebShare component. Successful exploitation could allow a remote attacker to corrupt memory and execute arbitrary code by convincing a user to visit a specially crafted webpage.

CVE-2026-12438 – Inappropriate Implementation in WebView

An implementation flaw in WebView could allow attackers to bypass intended security controls. Exploitation may lead to unauthorized actions within the browser context and could be leveraged as part of a larger attack chain.

CVE-2026-12439 – Use-After-Free in Digital Credentials

This vulnerability affects the Digital Credentials component and stems from improper memory handling. An attacker could trigger memory corruption through crafted web content, potentially resulting in arbitrary code execution.

CVE-2026-12440 – Use-After-Free in Digital Credentials

A second use-after-free flaw was identified in the Digital Credentials functionality. Successful exploitation may allow attackers to gain control over browser processes and execute malicious code.

CVE-2026-12441 – Use-After-Free in File Input

The File Input component contains a memory corruption issue caused by accessing freed memory. A malicious webpage could exploit this flaw to crash the browser or execute attacker-controlled code.

CVE-2026-12442 – Use-After-Free in Passwords

This vulnerability affects Chrome's password management functionality. Attackers may exploit the flaw through crafted content to achieve code execution within the browser environment.

CVE-2026-12443 – Use-After-Free in Web Authentication

A use-after-free issue in the Web Authentication component could enable memory corruption. Successful exploitation may result in arbitrary code execution and compromise of the affected system.

CVE-2026-12444 – Out-of-Bounds Read in Chromoting

An out-of-bounds read vulnerability exists in Chromoting. Exploitation may allow attackers to access sensitive memory contents and potentially aid further attacks.

CVE-2026-12445 – Use-After-Free in Extensions

This flaw affects Chrome Extensions and results from improper memory management. Attackers could leverage the vulnerability to execute arbitrary code or destabilize the browser.

CVE-2026-12446 – Insufficient Data Validation in Passwords

Improper validation of input data within the Passwords component could allow unexpected behavior. Attackers may exploit the issue to bypass security controls or expose sensitive information.

CVE-2026-12447 – Heap Buffer Overflow in WebRTC

A heap buffer overflow vulnerability exists in WebRTC. Crafted network traffic or web content may trigger memory corruption, potentially leading to remote code execution.

CVE-2026-12448 – Inappropriate Implementation in WebView

An implementation weakness in WebView could allow attackers to manipulate browser behavior. The flaw may be used to weaken security boundaries and facilitate additional exploitation.

CVE-2026-12449 – Use-After-Free in Chromoting

This memory corruption vulnerability affects the Chromoting component. Successful exploitation could enable arbitrary code execution within the browser process.

CVE-2026-12450 – Inappropriate Implementation in Media

A security weakness in the Media component could allow attackers to exploit unexpected application behavior. Depending on the attack scenario, it may contribute to privilege escalation or code execution.

CVE-2026-12451 – Use-After-Free in Digital Credentials

Improper memory handling within Digital Credentials can result in a use-after-free condition. Attackers may exploit the flaw to gain code execution capabilities through malicious web content.

CVE-2026-12452 – Use-After-Free in Downloads

A use-after-free vulnerability was discovered in Chrome's Downloads component. Exploitation may allow attackers to execute arbitrary code or cause browser instability.

CVE-2026-12453 – Insufficient Validation of Untrusted Input in Input

The Input component fails to properly validate untrusted data. Attackers may leverage this weakness to trigger unexpected behavior or bypass security mechanisms.

CVE-2026-12454 – Race Condition in Safe Browsing

A race condition vulnerability exists within Safe Browsing. Under specific circumstances, attackers may exploit timing issues to circumvent security protections.

CVE-2026-12455 – Use-After-Free in Tab Strip

This memory corruption flaw affects Chrome's Tab Strip functionality. A successful attack could lead to arbitrary code execution through specially crafted browser interactions.

CVE-2026-12456 – Insufficient Validation of Untrusted Input in Extensions

Improper validation of extension-related input may allow attackers to manipulate extension behavior. Exploitation could weaken browser security and enable unauthorized actions.

CVE-2026-12457 – Insufficient Data Validation in Extensions

This vulnerability stems from inadequate data validation in Chrome Extensions. Attackers may exploit the flaw to trigger unintended operations or compromise extension integrity.

CVE-2026-12458 – Incorrect Security UI in Passwords

The Passwords component contains a user interface security issue. Attackers could potentially mislead users regarding security-sensitive actions or credential-related operations.

CVE-2026-12459 – Inappropriate Implementation in Serial

An implementation flaw within the Serial API could expose browser functionality to misuse. Exploitation may lead to unauthorized interactions with connected devices.

CVE-2026-12460 – Insufficient Policy Enforcement in File System Access

The File System Access component does not properly enforce security policies. Attackers may exploit this weakness to gain broader access to local files than intended.

CVE-2026-12461 – Out-of-Bounds Read in WebRTC

A memory access issue in WebRTC could allow attackers to read unintended memory locations. This may expose sensitive information and assist in further exploitation.

CVE-2026-12462 – Use-After-Free in Media

A use-after-free vulnerability affects the Media component. Exploitation could result in memory corruption, browser crashes, or arbitrary code execution.

CVE-2026-12463 – Inappropriate Implementation in Views

An implementation weakness was identified in the Views component. Attackers may leverage the flaw to trigger unexpected behavior and potentially compromise browser security.

CVE-2026-12464 – Use-After-Free in Browser

This vulnerability impacts core browser functionality and involves improper memory handling. Successful exploitation could provide attackers with code execution capabilities.

CVE-2026-12465 – Insufficient Validation of Untrusted Input in Metrics

The Metrics component improperly validates user-controlled input. Attackers may exploit the issue to manipulate application behavior or trigger security-relevant conditions.

CVE-2026-12466 – Heap Buffer Overflow in WebRTC

A heap buffer overflow in WebRTC can lead to memory corruption. Remote attackers may exploit the flaw through crafted content to achieve arbitrary code execution.

CVE-2026-12467 – Use-After-Free in Extensions

This memory corruption vulnerability affects Chrome Extensions. Successful exploitation may allow attackers to execute code within the browser environment.

CVE-2026-12468 – Inappropriate Implementation in Updater

A security weakness in the Chrome Updater component could impact update-related processes. Attackers may exploit the flaw to interfere with normal update operations.

CVE-2026-12469 – Uninitialized Use in GPU

The GPU component contains an uninitialized memory usage vulnerability. Exploitation may expose sensitive data from memory or contribute to more complex attack chains.

RECOMMENDATION:

We strongly recommend you update Google Chrome to version 149.0.7827.155/.156 (Windows and macOS) and 149.0.7827.155 (Linux).

REFERENCES:

The following reports contain further technical details:

https://cybersecuritynews.com/chrome-vulnerabilities-execute-arbitrary-code/