Chrome CVE-2026-4446

The victim must open a crafted HTML page in Google Chrome prior to version 146.0.7680.153. Requires WebRTC functionality enabled (default). Remote attacker delivers malicious HTML; no authentication needed.

This vulnerability presents a moderate-to-high real-world risk despite the unavailable CVSS vector and EPSS score. The attack vector is Network with Low complexity (user must visit a crafted page, but no special privileges required), making it readily exploitable in drive-by attack scenarios. The technical impact is significant: heap corruption can lead to denial of service or, with heap grooming techniques, arbitrary code execution with Chrome's sandbox privileges. No KEV (Known Exploited Vulnerability) status is indicated in the provided data, suggesting either no public in-the-wild exploitation or delayed disclosure; however, the High Chromium severity rating and the availability of a patch indicate Google's assessment of genuine exploitation risk. The presence of a vendor patch and public advisory (March 2026) suggests the vulnerability was responsibly disclosed. Automatable exploitation is likely feasible given the remote attack vector and deterministic memory corruption in WebRTC, elevating practical risk despite the lack of quantitative EPSS data.

An attacker hosts a malicious website containing embedded JavaScript that initiates a series of WebRTC peer connection operations, deliberately triggering state transitions that expose the use-after-free condition in Chrome's WebRTC memory management. When a victim with unpatched Chrome visits the site (via phishing email, malvertising, or social engineering), the JavaScript executes in the renderer process, causing the heap corruption. Depending on heap layout and attacker sophistication, this can crash the browser (denial of service) or, with heap grooming techniques, enable code execution within the Chrome sandbox. No public proof-of-concept has been reported in the provided data, but the remote network attack vector and relatively low complexity suggest such a POC could be developed quickly post-disclosure.