Chrome CVE-2026-4451

Requires Google Chrome versions prior to 146.0.7680.153 with compromised renderer process. Victim must open a crafted HTML page. Attack chains from browser vulnerabilities enabling renderer compromise, then sandbox escape via navigation validation bypass.

Risk assessment is constrained by unavailable CVSS vector and EPSS scores, but multiple factors indicate this is a legitimate high-priority vulnerability. First, the attack vector requires prior renderer compromise, which is a significant prerequisite—this is a post-compromise privilege escalation rather than a direct remote code execution vector. However, renderer compromises are routinely achieved through JavaScript exploits or malicious website visits, making the two-stage attack realistic. Second, the vulnerability is confined to navigation input validation (a well-audited component), reducing likelihood of widespread zero-day exploitation. Third, patch availability and vendor response indicate this was responsibly disclosed and patched. The High severity rating from Chromium reflects the significant impact (sandbox escape = full system compromise) despite moderate accessibility. SSVC framing: exploitation is Functional (patch available), impact is Total (sandbox escape), and automatable exploitation is Moderate (requires prior renderer access). Real-world priority should be elevated due to the post-compromise privilege escalation scenario, but this is not a widespread unpatched zero-day.

An attacker first compromises a victim's Chrome renderer process through a traditional vector such as a malicious website, malware injection, or JavaScript exploit. Once in the renderer sandbox, the attacker crafts a specially designed HTML page (or navigates the compromised renderer to one) containing input that bypasses Navigation component validation. The malformed navigation input is processed by the browser kernel process, allowing the attacker to escape the renderer sandbox and execute arbitrary code with the privileges of the Chrome process (typically the user's full privilege level). This converts a renderer-level compromise into full host system compromise.