Chrome CVE-2026-4445

The victim must open a crafted HTML page in Google Chrome prior to version 146.0.7680.153. Requires WebRTC enabled (default). Remote unauthenticated attacker exploits heap corruption via use-after-free vulnerability.

While CVSS and EPSS scores are not available in the provided intelligence, the risk profile can be reconstructed from multiple signals. The Chromium High severity rating and CWE-416 classification indicate memory corruption with potential for denial of service and possibly code execution, which typically maps to CVSS Base Score 7.0–8.0 range depending on attack vector and complexity. The attack vector is Network and requires only that a victim visit a malicious website, suggesting low attack complexity and no special privileges required, factors that elevate real-world risk. The availability of a vendor patch from Google and tracking across nine Debian releases indicates both the breadth of impact and the maturity of the fix. No public exploit proof-of-concept is mentioned, but the detailed Chromium issue tracker reference (issues.chromium.org/issues/486421953) may contain technical specifics useful to adversaries. Given the remote attack vector, the high base severity, the widespread distribution through Debian and Chrome auto-update, and the fact that WebRTC is enabled by default in most Chrome installations, this represents a real and material risk to desktop users. However, the absence of KEV designation or active exploitation reports at the time of patch release suggests this may not be zero-day or broadly exploited in the wild. Priority should be set to 'High' with immediate patching recommended, particularly for enterprise deployments where browser isolation and update enforcement are critical.

An attacker hosts a malicious website containing carefully crafted HTML and JavaScript that triggers specific WebRTC object allocation and deallocation sequences. When a victim visits this page in a vulnerable Chrome browser (prior to 146.0.7680.153), the malicious code causes the WebRTC component to free a critical data structure but continue referencing it in subsequent operations. The freed memory is reallocated by the heap manager for another object (e.g., a string buffer or DOM node), and the use-after-free writes corrupt this new object's metadata or contents. The attacker can leverage the corrupted state to cause denial of service (crash the renderer process) or, in a more sophisticated attack, achieve information disclosure or code execution by carefully controlling the heap layout and the contents of the reallocated memory. No public POC has been disclosed at the time of patch release, but the technical details in the Chromium issue tracker likely provide sufficient guidance for skilled threat actors to develop working exploits.