Chrome CVE-2026-4448

The victim must open or visit a crafted HTML page in Google Chrome versions prior to 146.0.7680.153. Remote unauthenticated attacker delivery via web link or email attachment. No special browser configuration required; default Chrome installations are vulnerable.

While a formal CVSS vector is unavailable, the High severity designation from Google's security team indicates this is a network-based attack (attack vector: network) with likely low complexity, requiring only user interaction to view a crafted webpage. The vulnerability affects rendering engines accessed automatically during normal browser operation, making exploitation highly probable. The ENISA EUVD tracking (EUVD-2026-13463) and Debian package tracking across 9 releases indicate widespread distribution and awareness among system administrators. Patches are readily available from the vendor, significantly reducing real-world risk for maintained systems. The absence of public exploit code and the availability of upstream fixes suggest this is a managed vulnerability rather than an actively exploited zero-day. Risk priority depends on deployment context: unpatched Chrome instances in user-facing or kiosk environments present elevated risk; organizations maintaining current patch cadences face minimal residual risk.

An attacker creates a malicious website containing specially crafted WebGL or graphics content that triggers a heap buffer overflow in Chrome's ANGLE library. When a user visits this webpage in their browser, the overflow is silently triggered during page rendering, allowing the attacker to corrupt adjacent heap structures and potentially achieve code execution within the Chrome process sandbox. The attack requires no user action beyond visiting the compromised site, making it suitable for drive-by exploitation via advertisement networks, malicious redirects, or compromised legitimate websites.