CVE-2026-12020: Use after free in Autofill in Google Chrome on Mac prior to 149

Synopsis

A use-after-free vulnerability exists in the Autofill component of Google Chrome on macOS in versions prior to 149.0.7827.115. The flaw is reachable over the network and requires no authentication, but does require a user to visit a crafted HTML page. Successful exploitation corrupts heap memory, giving an attacker the ability to read sensitive data, tamper with application state, or execute arbitrary code within the browser process. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the target to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credential of any privilege level is needed to deliver the malicious page.

• Victim interactionRequired

  The target user must visit the attacker-controlled HTML page, meaning the attack depends on a social-engineering or drive-by delivery step.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• A successful attacker reads heap memory contents from the Chrome process, which may include stored autofill data such as addresses, payment card numbers, and form credentials.
• The attacker modifies heap state within the browser process, enabling tampering with page content, session data, or in-process application logic.
• Heap corruption of this class opens a path to arbitrary code execution within the Chrome renderer or browser process on the affected Mac host.
• The Chrome process itself can be crashed, disrupting browser availability for the affected user.