Privilege Escalation in Google Chrome Android WebView

Publication date: 2026-06-17

Last updated on: 2026-06-18

Assigner: Chrome

Description

Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-17

Last Modified

2026-06-18

Generated

2026-07-08

AI Q&A

2026-06-17

EPSS Evaluated

2026-07-06

NVD

CVE-2026-12448

EUVD

EUVD-2026-37533

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 149.0.7827.155 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is due to an inappropriate implementation in the WebView component of Google Chrome on Android versions prior to 149.0.7827.155. It allows a remote attacker to escalate privileges by using a specially crafted HTML page.

Impact Analysis

The vulnerability can lead to privilege escalation, meaning an attacker could gain higher-level access than intended. This can compromise the security of your device or data by allowing unauthorized actions or access.

Hi! I’m here to help you understand CVE-2026-12448. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70