CVE-2026-12012

HighCVSS 8.1/10Last modified Oct 26, 2026

Description

Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network position to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
GoogleChrome>= 149.0.7827.115, < 149.0.7827.115

References

Timeline

Published
Jun 11, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1201358.2Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommCVE-2026-1201398.8Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system CVE-2026-120148.3Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to potentially perform a saCVE-2026-1201418.8Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system uCVE-2026-1201428.8Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running CVE-2026-1201438.8Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the dCVE-2026-1201448.8Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating systemCVE-2026-1201458.8Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system useCVE-2026-1201464.3Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It alCVE-2026-1201478.8Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running thCVE-2026-1201488.1Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running theCVE-2026-1201498.8Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inse
CVE-2026-12012: High severity, CVSS 8.1 | Vulnix