CVE-2026-12009: Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149

Synopsis

This is an insufficient input validation vulnerability in the Accessibility component of Google Chrome on macOS, affecting versions prior to 149.0.7827.115. It is reachable over the network and requires no authentication, though an attacker must already have compromised the Chrome renderer process and must convince a victim to visit a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker capabilities beyond the normally isolated renderer, including potential full confidentiality, integrity, and availability impact on the host. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by delivering a crafted HTML page, making over-the-network exposure a prerequisite.

• AuthenticationNot required

  No account or credentials are needed; the attack is launched against an unauthenticated browser session.

• Victim interactionRequired

  The victim must open a crafted HTML page, requiring the attacker to use phishing, malvertising, or another social-engineering vector to drive the visit.

• Attack complexityDetail

  Exploitation is rated high complexity because the attacker must already have compromised the renderer process before the sandbox escape can be attempted, introducing a significant prerequisite condition.

Blast Radius

• A successful sandbox escape lets the attacker read arbitrary files and data outside the Chrome renderer sandbox on the host macOS system.
• The attacker can write or modify files and system state beyond the sandbox boundary, enabling persistence or tampering with other applications.
• The attacker can crash or destabilize processes outside the renderer, disrupting the availability of the host system or co-located services.