CVE-2026-12451 is a use-after-free vulnerability in the DigitalCredentials feature of Google Chrome versions before 149.0.7827.155. Exploitation requires prior compromise of the renderer process and involves a crafted HTML page to potentially escape the browser sandbox. The vulnerability has a high CVSS score (8.3) indicating significant confidentiality, integrity, and availability impact. The vendor advisory URL is provided but does not explicitly state the patch or remediation status. The affected product is Google Chrome desktop, and this is not a cloud service vulnerability.

Successful exploitation could allow an attacker with control over the renderer process to escape the sandbox, potentially leading to execution of arbitrary code with higher privileges. This impacts confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html for current remediation guidance. Until confirmed, users should update to the latest Chrome version once available and avoid interacting with untrusted content that could trigger the vulnerability.