CVE-2026-12445 is a use-after-free vulnerability in the Extensions module of Google Chrome before version 149.0.7827.155. An attacker could exploit this by tricking a user into installing a crafted malicious extension, potentially leading to heap corruption. The vulnerability was publicly disclosed on June 17, 2026, with a vendor advisory link to a Chrome stable channel update blog post. No CVSS score or explicit remediation level is provided in the available data.

Successful exploitation could result in heap corruption, which may lead to arbitrary code execution or browser compromise. The attack requires user interaction in the form of installing a malicious extension. There are no known exploits in the wild at the time of disclosure.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html for current remediation guidance. Users should update to the latest Chrome version once available and avoid installing untrusted extensions.