CVE-2026-12463 is a vulnerability in the Views component of Google Chrome on Linux platforms before version 149.0.7827.155. It allows a remote attacker, with control over the renderer process, to perform UXSS by injecting arbitrary scripts or HTML through a crafted HTML page. This vulnerability arises from an inappropriate implementation in Views, enabling cross-site scripting attacks within the browser context. The vulnerability has been addressed in Chrome version 149.0.7827.155.

An attacker who has already compromised the renderer process can exploit this vulnerability to inject arbitrary scripts or HTML, potentially leading to UXSS attacks. This can undermine the security model of the browser by allowing malicious script execution in the context of trusted web pages, potentially leading to data theft, session hijacking, or other malicious activities within the browser environment.

A fixed version of Google Chrome is available at 149.0.7827.155. Users should update to this version or later to remediate the vulnerability. No additional vendor advisory indicates alternative mitigations or that no action is required. Therefore, applying the official update is the recommended remediation.