What is the CVSS score of CVE-2026-4443?

CVE-2026-4443 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ubuntu are affected by CVE-2026-4443?

Organizations using WebAudio in Google Chrome face significant risk from CVE-2026-4443, a heap-based buffer overflow vulnerability rated CVSS 8.8.. A patch is available.

How to fix or mitigate CVE-2026-4443?

Within 7 days: Identify all affected systems running WebAudio in Google Chrome and apply vendor patches promptly. If patching is delayed, consider network segmentation to limit exposure.

Ubuntu CVE-2026-4443

EUVD-2026-13453 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-03-20 chrome-cve-admin@google.com

Google Heap Overflow RCE Buffer Overflow Ubuntu Debian Chrome Red Hat Suse

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Ubuntu

MEDIUM

qualitative

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 20, 2026 - 08:46 nvd

Patch available

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13453

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 02:16 nvd

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandboxed arbitrary code execution in Google Chrome's WebAudio component (versions prior to 146.0.7680.153) can be triggered remotely through malicious HTML, requiring only user interaction. An attacker can craft a weaponized webpage to break out of the Chrome sandbox and execute arbitrary code on affected systems. This high-severity vulnerability impacts Chrome, Ubuntu, and Debian users, with patches now available.

Technical ContextAI

The vulnerability is rooted in CWE-122 (Heap-based Buffer Overflow), a memory safety issue in the WebAudio subsystem—Chrome's implementation of the Web Audio API standard. The WebAudio component processes audio data and parameters, and the heap overflow occurs when untrusted audio processing input is not properly bounds-checked before writing to heap-allocated memory buffers. This class of vulnerability is particularly dangerous in browser contexts because heap corruption can enable arbitrary code execution and break sandbox isolation. The affected product is Google Chrome (all platforms), identified by vendor Google with internal issue tracking at https://issues.chromium.org/issues/485292589, confirming the flaw originates from Chromium's WebAudio implementation.

RemediationAI

Update Google Chrome to version 146.0.7680.153 or later immediately using the vendor update mechanism (Help > About Google Chrome, which auto-updates on most platforms, or manual download from https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html). For enterprise environments, deploy via MDM/ConfigurationManagement with forced update policies to ensure rapid coverage. Debian users should update the chromium or google-chrome package to the patched version from their respective repositories. Until patches are applied, network-level mitigation is limited but organizations can enforce policies restricting access to untrusted websites and disable JavaScript execution where operationally feasible (though this significantly degrades functionality). Monitor for any public exploits or proof-of-concept code and ensure patch deployment is prioritized within 72 hours given the RCE vector and ease of weaponization.

More in Chrome

View all

CVE-2015-5122 CRITICAL Emergency POC

9.8 Jul 14

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player

CVE-2016-5198 HIGH Act Now POC

8.8 Jan 19

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac

CVE-2017-5070 HIGH Act Now POC

8.8 Oct 27

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a

CVE-2016-1646 HIGH Act Now POC

8.8 Mar 29

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do

CVE-2013-0758 CRITICAL Emergency POC

9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb

CVE-2017-5030 HIGH Act Now POC

8.8 Apr 24

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.

CVE-2012-3993 CRITICAL Emergency POC

9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi

CVE-2017-3823 HIGH Act Now POC

8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta

CVE-2014-8636 HIGH Act Now POC

7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL Emergency POC

9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi

CVE-2014-1510 CRITICAL Emergency POC

9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se

CVE-2015-5123 CRITICAL Emergency

9.8 Jul 14

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13

Same weakness CWE-122 – Heap-based Buffer Overflow

View all

CVE-2023-4911 HIGH POC

7.8

CVE-2025-24985 HIGH POC

7.8

CVE-2025-21418 HIGH

7.8

CVE-2025-24993 HIGH

7.8

CVE-2023-6246 HIGH POC

8.4

CVE-2026-42945 CRITICAL POC

9.2

CVE-2014-0781 CRITICAL POC

9.3

CVE-2024-30085 HIGH POC

7.8

Same technique Heap Overflow

View all

CVE-2023-4911 HIGH POC

7.8

CVE-2025-5419 HIGH POC

8.8

CVE-2025-21418 HIGH

7.8

CVE-2023-6246 HIGH POC

8.4

CVE-2026-42945 CRITICAL POC

9.2

CVE-2014-0781 CRITICAL POC

9.3

CVE-2024-30085 HIGH POC

7.8

CVE-2024-30038 HIGH POC

7.8

Vendor StatusVendor

Ubuntu

Priority: Medium

chromium-browser

Release	Status	Version
jammy	not-affected	code not present
noble	not-affected	code not present
questing	not-affected	code not present
upstream	released	-

Debian

chromium

Release	Status	Fixed Version	Urgency
bullseye (security), bullseye	vulnerable	120.0.6099.224-1~deb11u1	-
bookworm	fixed	146.0.7680.153-1~deb12u1	-
bookworm (security)	fixed	146.0.7680.153-1~deb12u1	-
trixie	fixed	146.0.7680.153-1~deb13u1	-
trixie (security)	fixed	146.0.7680.153-1~deb13u1	-
forky	vulnerable	146.0.7680.80-1	-
sid	fixed	146.0.7680.153-1	-
bullseye	fixed	(unfixed)	end-of-life
(unstable)	fixed	146.0.7680.153-1	-

DSA-6171-1

SUSE

Severity: High

Product	Status
SUSE Package Hub 15 SP6	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Package Hub 15 SP6	Fixed

CVE-2026-4443 vulnerability details – vuln.today

Back

Ubuntu CVE-2026-4443

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Chrome

Same weakness CWE-122 – Heap-based Buffer Overflow

Same technique Heap Overflow

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code