CVE-2026-12467 is a use-after-free vulnerability affecting the Extensions component in Google Chrome versions before 149.0.7827.155. Exploitation requires that the attacker has already compromised the renderer process, after which they could leverage this vulnerability to perform a sandbox escape. The vulnerability is triggered via a crafted HTML page. The CVSS 3.1 base score is 8.3, reflecting high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at the time of publication. The vendor advisory linked corresponds to a stable channel update addressing this issue.

Successful exploitation could allow an attacker with renderer process access to escape the Chrome sandbox, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected system. This elevates the risk of remote code execution beyond the sandbox protections.

A fix is available in Google Chrome version 149.0.7827.155. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html for detailed update instructions.