CVE-2026-12440 is a use-after-free vulnerability in the DigitalCredentials feature of Google Chrome on Windows platforms before version 149.0.7827.155. Exploitation could enable a remote attacker to perform a sandbox escape via a specially crafted HTML page, potentially leading to full compromise of the affected system. The vulnerability has a CVSS v3.1 base score of 9.6, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The vendor advisory URL is provided but does not explicitly state the patch status or remediation level in the input data.

Successful exploitation of this vulnerability could allow a remote attacker to escape the Chrome sandbox, potentially leading to arbitrary code execution with elevated privileges on the affected Windows system. This could compromise confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html for current remediation guidance. Users and administrators should apply the update to Chrome version 149.0.7827.155 or later once available to mitigate this vulnerability.