PT-2026-50210 · Google · Google Chrome

CVE-2026-12460 · Published 2026-06-17 · Updated 2026-06-20

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.155

Description Insufficient policy enforcement in File System Access allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted PDF file. Site isolation is a security mechanism that ensures pages from different sites are run in separate processes to prevent data theft.

Recommendations Update Google Chrome to version 149.0.7827.155 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-12460

ECHO-F5AD-C699-B751

OPENSUSE-SU-2026:11071-1

OPENSUSE-SU-2026:21135-1

Affected Products

Google Chrome

References · 44

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-12460 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-12460 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12460 · Security Note
• https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11071-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21135-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-12460 · Security Note
• https://suse.com/security/cve/CVE-2026-12450 · Note
• https://suse.com/security/cve/CVE-2026-12441 · Note
• https://suse.com/security/cve/CVE-2026-12445 · Note
• https://suse.com/security/cve/CVE-2026-12442 · Note
• https://suse.com/security/cve/CVE-2026-12460 · Note
• https://suse.com/security/cve/CVE-2026-12454 · Note
• https://suse.com/security/cve/CVE-2026-12437 · Note
• https://suse.com/security/cve/CVE-2026-12439 · Note