Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Google
  • Chrome

No data.

No data.

References
Link Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html cve-icon cve-icon
https://issues.chromium.org/issues/518042749 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-12463 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-12463 cve-icon
History

Fri, 19 Jun 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.0, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Fri, 19 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title Chrome UXSS via Renderer Compromise on Linux chromium-browser: chromium-browser: Inappropriate implementation in Views
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.0, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N'}

threat_severity

Important

Thu, 18 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Title Chrome UXSS via Renderer Compromise on Linux
Weaknesses CWE-79

Wed, 17 Jun 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 17 Jun 2026 05:15:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2026-06-17T01:38:24.023Z

Updated: 2026-06-17T13:17:20.990Z

Reserved: 2026-06-16T19:38:32.463Z

Link: CVE-2026-12463

cve-icon Vulnrichment

Updated: 2026-06-17T13:17:15.330Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-06-17T01:38:24Z

Links: CVE-2026-12463 - Bugzilla