CVE-2026-12032

LowCVSS 3.1/10Last modified Oct 26, 2026

Description

Inappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1203204.7A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context ofCVE-2026-1203229.9A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manCVE-2026-1203234.3A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthrouCVE-2026-1203248.3A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file CVE-2026-1203256.3A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packagCVE-2026-1203264.8DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. WhenCVE-2026-1203275.3The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect useCVE-2026-1203286.9The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers canCVE-2026-1203295.3Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuraCVE-2026-120335.3Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the GPU process toCVE-2026-1203307.1Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recCVE-2026-1203315.3Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend us
CVE-2026-12032: Low severity, CVSS 3.1 | Vulnix