CVE-2026-12460

MediumCVSS 4.2/10Last modified Oct 26, 2026

Description

Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: High)

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.155, < 149.0.7827.155

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.htmlVendor Advisory
https://issues.chromium.org/issues/517484284Permissions Required

Timeline

Published: Jun 17, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-12460010.0GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encr CVE-2026-1246016.2An API key is hardcoded and retrievable from the GV-Access package. Since Android applications can be reverse engineered, embedding sensitiv CVE-2026-1246026.2The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access application package. Because An CVE-2026-1246036.2An API key is hardcoded and retrievable from the GV-Cloud application package. Since Android applications can be reverse engineered, embeddi CVE-2026-1246046.2The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Cloud application package. Because And CVE-2026-124616.5Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive i CVE-2026-124627.5Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execu CVE-2026-1246217.4A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects CVE-2026-1246225.3A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such CVE-2026-1246234.7A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/m CVE-2026-1246245.3A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash_hmac of the file pp-content/pp-include CVE-2026-1246256.3A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-in