CVE-2026-12462

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.155, < 149.0.7827.155

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.htmlVendor Advisory
https://issues.chromium.org/issues/517916024Permissions Required

Timeline

Published: Jun 17, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1246217.4A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects CVE-2026-1246225.3A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such CVE-2026-1246234.7A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/m CVE-2026-1246245.3A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash_hmac of the file pp-content/pp-include CVE-2026-1246256.3A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-in CVE-2026-1246278.7In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that CVE-2026-1246288.7In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that ide CVE-2026-124634.7Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the re CVE-2026-1246354.7A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the c CVE-2026-1246363.8A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function save_page of the file includes/li CVE-2026-1246375.3A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a CVE-2026-124648.3Use after free in Browser in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to pot