CVE-2026-12452: Google Chrome Use After Free Vulnerability

CVE-2026-12452 Overview

CVE-2026-12452 is a use-after-free vulnerability in the Downloads component of Google Chrome on Android. Versions prior to 149.0.7827.155 are affected. A remote attacker can exploit heap corruption by enticing a user to load a crafted HTML page. Google rates the underlying Chromium security severity as High.

The flaw maps to [CWE-416] (Use After Free) and carries a CVSS 3.1 base score of 8.8. Successful exploitation requires user interaction but no authentication, and an attacker can target the browser remotely over the network. Compromise can lead to arbitrary code execution within the Chrome renderer or browser process on Android devices.

Critical Impact
A remote attacker can trigger heap corruption through a crafted HTML page, potentially leading to arbitrary code execution in Chrome on Android.

Affected Products

Google Chrome on Android prior to 149.0.7827.155
Google Android devices running vulnerable Chrome builds
Chromium-based browsers sharing the affected Downloads component

Discovery Timeline

2026-06-17 - CVE-2026-12452 published to the National Vulnerability Database (NVD)
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-12452

Vulnerability Analysis

The vulnerability resides in the Downloads subsystem of Google Chrome on Android. The Downloads component manages lifecycle objects associated with file transfers, including request handles, UI notifiers, and progress trackers. A use-after-free condition allows attacker-controlled code paths to reference memory that has already been deallocated.

When the affected object is freed but a dangling pointer remains reachable, subsequent operations dereference the stale pointer. This produces heap corruption that an attacker can shape to overwrite function pointers, virtual table entries, or adjacent heap metadata. The user interaction requirement is minimal: the victim only needs to visit a malicious page or click a crafted link that initiates a download flow.

Root Cause

The root cause is improper object lifetime management within the Downloads component. The code releases a heap-allocated structure while another execution path still holds a pointer to it. Without reference counting or invalidation of that pointer, the freed memory can be reallocated for attacker-controlled data before reuse. This pattern is consistent with prior Chromium [CWE-416] issues tracked in the Chromium Issue Tracker Entry.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page that triggers a sequence of download-related operations to free an internal object while retaining a reference to it. The attacker then reuses the freed slot with controlled data and forces the dangling reference to be dereferenced. The resulting heap corruption can be leveraged to hijack control flow inside the Chrome process on Android.

The vulnerability manifests within Chromium's Downloads object lifecycle. No verified public proof-of-concept is available. See the Google Chrome Stable Update advisory for vendor-supplied technical context.

Detection Methods for CVE-2026-12452

Indicators of Compromise

Unexpected Chrome process crashes on Android devices, particularly tab or renderer crashes referencing download components in logcat or crash reports.
Outbound connections from mobile devices to newly registered domains immediately followed by Chrome instability.
Unusual file artifacts in the Android Downloads directory created shortly before a browser crash.

Detection Strategies

Inventory Chrome for Android versions across managed mobile devices and flag any build below 149.0.7827.155.
Correlate web proxy logs with mobile device telemetry to identify users visiting suspicious URLs that trigger download events.
Hunt for crash signatures in Android system logs that include heap corruption indicators tied to Chromium Downloads code paths.

Monitoring Recommendations

Enable mobile threat defense telemetry and forward Chrome crash data to a centralized SIEM or data lake for analysis.
Monitor for unpatched Chrome installations through enterprise mobility management (EMM) compliance policies.
Track DNS and HTTP traffic patterns to detect drive-by download lures targeting Android browsers.

How to Mitigate CVE-2026-12452

Immediate Actions Required

Update Google Chrome on Android to version 149.0.7827.155 or later through the Google Play Store.
Push the updated Chrome build through enterprise mobility management to all managed Android devices.
Notify users to avoid clicking untrusted links and to restart Chrome to ensure the patched version is active.

Patch Information

Google released the fix in Chrome 149.0.7827.155 for Android. Refer to the Google Chrome Stable Update advisory and the Chromium Issue Tracker Entry for vendor details. Apply the update through Google Play or managed app distribution channels.

Workarounds

Restrict browsing to trusted sites until the Chrome update is installed on all Android endpoints.
Use alternate browsers that are not based on the affected Chromium build for high-risk browsing activity.
Enforce mobile device compliance policies that block access to corporate resources from devices running outdated Chrome versions.

bash

# Verify Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should show 149.0.7827.155 or later