cve-2026-12019

CVE-2026-12019 is a high-severity heap buffer overflow vulnerability in Google Chrome's Codecs component, disclosed on June 11, 2026. It affects Chrome on Linux and ChromeOS before version 149.0.7827.115. The flaw can be triggered via a crafted HTML page and may allow sandbox escape, meaning an attacker who has already compromised the renderer process could break out of the browser's security sandbox. This vulnerability is particularly concerning because it targets the second stage of a browser compromise, where Chrome's security model is supposed to prevent further escalation. Users are advised to update Chrome immediately to mitigate the risk.