CVE-2026-12458: Google Chrome Information Disclosure Bug

CVE-2026-12458 Overview

CVE-2026-12458 is an inappropriate implementation flaw in the Passwords component of Google Chrome prior to version 149.0.7827.155. A remote attacker can leak cross-origin data by convincing a user to perform specific user interface gestures on a crafted HTML page. The issue is classified under CWE-451: User Interface (UI) Misrepresentation of Critical Information. Chromium's internal triage rated the severity as High, though the public CVSS 3.1 base score is 3.1 due to high attack complexity and required user interaction. The vulnerability affects Chrome on Windows, macOS, and Linux desktop platforms.

Critical Impact
An attacker who lures a victim into performing specific UI gestures on a malicious page can exfiltrate cross-origin data, breaking the same-origin policy enforced by the Passwords subsystem.

Affected Products

Google Chrome prior to 149.0.7827.155
Apple macOS desktop builds of Chrome
Microsoft Windows desktop builds of Chrome
Linux desktop builds of Chrome

Discovery Timeline

2026-06-17 - CVE-2026-12458 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12458

Vulnerability Analysis

The defect resides in the Passwords feature of Google Chrome, which manages stored credentials and credential prompts across origins. An attacker hosting a crafted HTML page can structure the document so that specific user interface gestures, such as clicks, drag operations, or focus changes, cause the Passwords component to expose data that should be isolated by origin. The flaw maps to CWE-451, indicating the UI does not accurately represent the security context of the action a user is taking. Successful exploitation results in confidentiality impact only, with no direct modification of data or disruption of service.

Root Cause

The root cause is an implementation defect in how the Passwords UI surfaces and processes user-initiated events relative to cross-origin frames or contexts. The component fails to fully enforce origin boundaries when responding to UI gestures, allowing data from one origin to be observable from another. Refer to the Chromium Issue Tracker Entry for additional technical context once the entry becomes publicly accessible.

Attack Vector

Exploitation requires the victim to visit a malicious or compromised web page and perform a specific sequence of UI interactions. Because the attack relies on user gestures and a non-trivial interaction sequence, attack complexity is rated High. No privileges are required, and the attacker operates remotely over the network. The EPSS score is 0.185%, reflecting a low probability of observed exploitation activity. No public proof-of-concept exploit, exploit database entry, or CISA KEV listing exists for this issue at the time of publication.

No verified exploitation code is publicly available. See the Chromium Issue Tracker Entry and the Chrome Stable Channel Update for vendor-provided technical references.

Detection Methods for CVE-2026-12458

Indicators of Compromise

Chrome browser processes running versions below 149.0.7827.155 after the patch release window
Outbound connections from browser sessions to unknown or newly registered domains hosting credential-themed lures
Browser telemetry showing unusual focus, drag, or click sequences on embedded cross-origin frames

Detection Strategies

Inventory deployed Chrome versions across Windows, macOS, and Linux endpoints and flag installations below 149.0.7827.155
Monitor web proxy and DNS logs for user visits to suspicious pages immediately preceding anomalous credential autofill events
Correlate browser version telemetry with endpoint identity events to detect potential credential leakage attempts

Monitoring Recommendations

Enable enterprise reporting in Chrome to centralize version and extension data for vulnerability tracking
Alert on Chrome installations that fall behind the current stable channel for more than one release cycle
Review authentication anomalies for accounts whose users browse from out-of-date Chrome builds

How to Mitigate CVE-2026-12458

Immediate Actions Required

Update Google Chrome to version 149.0.7827.155 or later on all Windows, macOS, and Linux endpoints
Force-restart Chrome after the update so the patched binary is loaded into memory
Validate update deployment through enterprise management consoles or endpoint inventory tooling

Patch Information

Google released the fix in the stable channel update covered by the Chrome Stable Channel Update. Administrators should ensure auto-update is enabled and verify the running version matches or exceeds 149.0.7827.155.

Workarounds

Restrict browsing to trusted sites through web filtering policies until patching completes
Disable Chrome password manager via the PasswordManagerEnabled enterprise policy for high-risk users
Train users to avoid performing unsolicited UI gestures, such as drag actions or repeated clicks, on unfamiliar web pages

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Example enterprise policy to disable the password manager during remediation
# Linux: /etc/opt/chrome/policies/managed/disable_pw_manager.json
{
  "PasswordManagerEnabled": false
}