Threat Intelligence Database

CVE-2026-12460 is a vulnerability in Google Chrome's File System Access feature prior to version 149.0.7827.155. It allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted PDF file. This vulnerability is classified with high severity by the Chromium security team. A fix is available in Chrome version 149.0.7827.155.

CVE-2026-12443 is a use-after-free vulnerability in the Web Authentication component of Google Chrome prior to version 149.0.7827.155. This flaw allows a remote attacker to execute arbitrary code by tricking a user into visiting a crafted HTML page. The vulnerability is classified as critical by Chromium security. A fixed version, 149.0.7827.155, is available. No known exploits in the wild have been reported at this time.

Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in MediaCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in Dawn in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

A use-after-free vulnerability exists in the Views component of Google Chrome on Windows versions prior to 149.0.7827.103. This flaw could allow a remote attacker who has already compromised the renderer process to potentially escape the sandbox by using a specially crafted HTML page. The vulnerability is rated with high severity and has a CVSS score of 8.3.

CVE-2026-11660 is a high-severity vulnerability in Google Chrome prior to version 149.0.7827.103. It involves insufficient validation of untrusted input on the New Tab Page, which could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The vulnerability has a CVSS score of 8.3, indicating a significant impact on confidentiality, integrity, and availability.