Is CVE-2026-12466 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12466 being exploited in the wild.

How severe is CVE-2026-12466?

High severity, with a CVSS score of 8.8, published 17 June 2026.

Which products and versions are affected?

Google Chrome prior to 149.0.7827.155.

Is there a fix for CVE-2026-12466?

A patch was published on 2026-06-16: Stable channel update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12466 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12466?

Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12466: Google Chrome heap buffer overflow in WebRTC

CVE-2026-12466 · Severity: high · CVSS 8.8 · Published 2026-06-17

Google Chrome is a widely used web browser. A vulnerability in its WebRTC component, which handles real-time communication like video and audio calls, could allow an attacker to take control of a user's computer. This occurs if a user visits a specially crafted, malicious website, potentially leading to unauthorized data access or system compromise.

Technologies: Google Chrome. Vendors: Google.

Quick answers

Is CVE-2026-12466 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12466 being exploited in the wild.
How severe is CVE-2026-12466?: High severity, with a CVSS score of 8.8, published 17 June 2026.
Which products and versions are affected?: Google Chrome prior to 149.0.7827.155.
Is there a fix for CVE-2026-12466?: A patch was published on 2026-06-16: Stable channel update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12466 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12466?: Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the WebRTC component of Google Chrome for Windows. The vulnerability is triggered when the browser processes a specially crafted HTML page, allowing a remote attacker to achieve arbitrary code execution within the context of the browser process. The attack vector is network-based and requires minimal user interaction (visiting a malicious site). This issue was addressed in Chrome version 149.0.7827.155.

Affected products

Google Chrome prior to 149.0.7827.155

Timeline

2026-06-05: other: Reported to Google
2026-06-16: patched: Stable channel update released
2026-06-17: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.