CVE-2026-12015

MediumCVSS 5.3/10Last modified Oct 26, 2026

Description

Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.115, < 149.0.7827.115

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.htmlVendor Advisory
https://issues.chromium.org/issues/515463295Issue Tracking, Permissions Required

Timeline

Published: Jun 11, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1201508.8Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user r CVE-2026-1201518.8Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user CVE-2026-1201524.3Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the funct CVE-2026-1201537.2SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code CVE-2026-1201544.3Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the t CVE-2026-120168.3Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer CVE-2026-120173.1Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the render CVE-2026-120188.8Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to perform OS-level privil CVE-2026-1201854.7A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/control CVE-2026-12018910.0A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftp CVE-2026-120198.3Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised CVE-2026-1201903.5A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file u