CVE-2026-12447 is a heap buffer overflow vulnerability in the WebRTC implementation of Google Chrome. It affects versions before 149.0.7827.155 and enables remote code execution inside the sandbox via a maliciously crafted HTML page. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and full confidentiality, integrity, and availability impact. The vendor advisory confirms the issue is fixed in Chrome 149.0.7827.155.

Successful exploitation allows a remote attacker to execute arbitrary code within the sandboxed environment of the browser, potentially compromising the confidentiality, integrity, and availability of the affected system. This could lead to unauthorized actions or data exposure within the browser context.

Users should update Google Chrome to version 149.0.7827.155 or later, where this vulnerability is fixed. The vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html provides official update information. No additional mitigations are specified by the vendor.