Chrome CVE-2026-4440

The victim must open a crafted HTML page in Google Chrome versions prior to 146.0.7680.153. WebGL must be enabled (default). Remote attacker sends the malicious page; no authentication required.

This vulnerability presents critical real-world risk despite missing CVSS vector and EPSS data. The attack vector is network-based (remote exploitation via HTML), requires no user privileges beyond viewing a malicious webpage, and the complexity is low—a crafted HTML file is sufficient. Google's designation of 'Critical' severity underscores the severity. The vulnerability affects a ubiquitous client-side application (Chrome), meaning the attack surface is enormous. Although KEV status and POC availability are not explicitly stated in the provided data, the presence of a vendor patch and detailed Chromium bug tracker reference (issues.chromium.org/issues/485935305) indicate this is a known, documented issue with high likelihood of exploit development. The ability to perform arbitrary read/write operations places this in the highest severity tier—exploitation could lead to arbitrary code execution, sandbox escape, or information theft.

An attacker crafts a malicious HTML webpage containing WebGL commands that trigger an out-of-bounds memory access. When a victim visits this page in a vulnerable version of Chrome, the WebGL pipeline processes the crafted commands without proper bounds validation, allowing the attacker to read sensitive data from Chrome's process memory (such as authentication tokens, encryption keys, or other user data) or write arbitrary code to executable memory regions to achieve code execution. The attack requires only that the victim view the webpage—no user interaction or additional privileges are needed—making this a dangerous vector for widespread exploitation via compromised websites or watering hole attacks.