CVE-2026-12459: Google Chrome XSS Vulnerability

CVE-2026-12459 Overview

CVE-2026-12459 is a Universal Cross-Site Scripting (UXSS) vulnerability in the Serial component of Google Chrome versions prior to 149.0.7827.155. The flaw stems from an inappropriate implementation that allows a remote attacker to inject arbitrary scripts or HTML through a crafted web page. Exploitation requires user interaction, such as visiting a malicious site. Chromium maintainers rated the underlying issue High severity, while the NVD assigned a CVSS 3.1 base score of 6.1. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
A remote attacker can bypass the same-origin policy and execute scripts in the context of arbitrary origins, enabling session hijacking, credential theft, and content manipulation.

Affected Products

Google Chrome prior to 149.0.7827.155
Chrome installations on Microsoft Windows
Chrome installations on Apple macOS and Linux

Discovery Timeline

2026-06-17 - CVE-2026-12459 published to NVD
2026-06-17 - Last updated in NVD database
June 2026 - Google releases fix in the Stable channel update for desktop (Google Chrome Stable Update)

Technical Details for CVE-2026-12459

Vulnerability Analysis

The vulnerability resides in Chrome's Serial component, which implements the Web Serial API for communication with serial devices from web content. An inappropriate implementation in this component allows attacker-controlled input to break out of its intended rendering context. The result is Universal Cross-Site Scripting, where injected scripts execute within the security context of other origins rather than only the attacker's page. Successful exploitation lets the attacker read cross-origin content, exfiltrate session tokens, and perform authenticated actions on behalf of the victim. Exploitation requires the victim to load a crafted HTML page, and the scope is changed under CVSS, reflecting the cross-origin impact.

Root Cause

The root cause is improper neutralization of input within the Serial component's rendering or message-handling logic, classified as [CWE-79]. Attacker-supplied data is not sufficiently sanitized or contextually escaped before it influences DOM construction or script execution paths. This permits HTML and script injection that bypasses the browser's origin isolation guarantees.

Attack Vector

The attack vector is network-based with no privileges required, but it does require user interaction. An attacker hosts a crafted HTML page and lures a victim using phishing, malvertising, or a compromised site. When the victim's browser processes the malicious markup through the vulnerable Serial code path, injected JavaScript runs with elevated origin context. No proof-of-concept is publicly listed in Exploit-DB, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.

Detailed technical context is available in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-12459

Indicators of Compromise

Browser processes loading unexpected JavaScript from unfamiliar domains immediately after visiting a new site.
Unusual cross-origin network requests originating from Chrome renderer processes, including credential or cookie exfiltration to attacker infrastructure.
Outbound HTTP POST traffic containing session identifiers shortly after user navigation to untrusted pages.

Detection Strategies

Inventory Chrome installations across the fleet and flag any version below 149.0.7827.155 as vulnerable.
Inspect web proxy and DNS telemetry for newly registered or low-reputation domains serving crafted HTML to users.
Correlate browser child process behavior with endpoint telemetry to surface anomalous script execution patterns following navigation events.

Monitoring Recommendations

Forward browser version data and navigation logs to a centralized analytics platform for continuous version drift monitoring.
Alert on cross-origin data access patterns and unexpected use of the Web Serial API by non-business applications.
Track Chrome stable channel release notes and Chromium issue tracker updates to validate patch coverage.

How to Mitigate CVE-2026-12459

Immediate Actions Required

Update Google Chrome to version 149.0.7827.155 or later on all Windows, macOS, and Linux endpoints.
Force-restart Chrome after the update so the patched binary is loaded; relaunch is required to apply the fix.
Validate enterprise Chrome deployment policies push the stable channel update across managed devices without delay.

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release 149.0.7827.155 for desktop. Administrators should consult the Google Chrome Stable Update advisory and the Chromium Issue Tracker Entry for component-level details. Chromium-based browsers that rebase on the same upstream version should also receive vendor updates.

Workarounds

Restrict access to the Web Serial API using the DefaultSerialGuardSetting enterprise policy until patching completes.
Block or restrict navigation to untrusted external sites through web filtering and DNS controls for high-risk user groups.
Disable Chrome extensions and features that interact with serial devices on systems that do not require this functionality.

bash

# Configuration example: enforce Chrome auto-update and disable Serial API via policy on Linux
sudo tee /etc/opt/chrome/policies/managed/cve-2026-12459.json > /dev/null <<'EOF'
{
  "DefaultSerialGuardSetting": 2,
  "SerialAskForUrls": [],
  "SerialBlockedForUrls": ["*"],
  "ComponentUpdatesEnabled": true
}
EOF