VulnIntel

CVE-2026-12009

CVSS 8.3 · HIGH
EPSS p14
Lower risk — in the top 86% least-likely-to-be-exploited CVEs.
Patch available
Vendor advisory or patch linked

Published 6/11/2026 · updated 6/12/2026 · CWE-20

Share
Get asset-aware triage

Summary

Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVSS 8.3 — HIGH

8.3 / 10
  • AV: Network
  • AC: High complexity
  • PR: No privileges
  • UI: User interaction
  • S: Scope changed
  • C: Confidentiality: High
  • I: Integrity: High
  • A: Availability: High

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS exploitation probability

0.2%

Percentile p14 — Lower risk — in the top 86% least-likely-to-be-exploited CVEs.

Affected products

1 vendor/product entries
  • Google Chrome< 149.0.7827.115
Do you run any of these? Sign in to match this CVE against your SBOM and asset inventory automatically.

Timeline

  1. Jun 11, 2026 · Disclosed / published in NVD
  2. Jun 12, 2026 · Intel last updated

Intel sources

Which upstream feeds returned data for this CVE, and when they were last fetched.

  • NVD· 47 days ago
  • CVE.org· no data
  • FIRST EPSS· 47 days ago
  • CISA KEV· no data
  • OSV· 47 days ago

References

Vendor & CERT advisories1
Other1

Unlock the full report

See how CVE-2026-12009 hits your stack.

Free public data ends here. Sign in to correlate this CVE against your SBOM and assets, get an AI-grounded exploit chain, generate a ModSecurity virtual patch, and share findings with your team.

  • · Asset-aware CVSS & priority
  • · Grounded AI analysis (A–D graded)
  • · Auto-generated WAF / IPS rules
  • · Jira, SIEM, Slack, Teams delivery

No credit card · 100 free enrichments · analyst-grade citations.