CVE-2026-12457
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker who compromised the renderer process to bypass site isolation via a crafted HTML page.
Risk Assessment
An attacker could gain access to data from other sites, posing a serious threat to user and organizational security.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Google Chrome Extensions
See all- CVE-2026-8587High
A use after free vulnerability in Extensions in Google Chrome on Mac prior to version 148.0.7778.168 allows an attacker to execute arbitrary code via a malicious extension if a user installs it.
- CVE-2016-1648High
A use-after-free vulnerability in the GetLoadTimes function in the Extensions implementation in Google Chrome before version 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
- CVE-2026-12467High
Use after free in Extensions in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-12456Medium
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension.
- CVE-2026-12445High
A use after free vulnerability in Extensions in Google Chrome prior to version 149.0.7827.155 allowed an attacker to exploit heap corruption via a malicious extension if a user installed it.
- CVE-2026-12017Low
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
- CVE-2023-4366High
Use after free in Extensions in Google Chrome prior to version 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
- CVE-2023-4078High
Inappropriate implementation in Extensions in Google Chrome prior to version 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.
- CVE-2023-4077High
Insufficient data validation in Extensions in Google Chrome prior to version 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.
Original NVD description (English source)
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)