Chrome CVE-2026-4452

The victim must open a crafted HTML page in Google Chrome on Windows versions prior to 146.0.7680.153. Remote unauthenticated attacker; user interaction required (visiting malicious webpage). No special Chrome configuration needed.

Despite the lack of assigned CVSS score and EPSS data in this intelligence package, multiple factors indicate elevated real-world risk. The vulnerability is classified as High severity by Chromium's own security assessment, which carries significant weight given Google's mature vulnerability evaluation processes. The attack vector is network-based with low complexity (requires only a crafted HTML page), meaning any user visiting a compromised or attacker-controlled website faces exploitation risk without additional user interaction. The availability of patches from the vendor and documentation in official Chrome release notes (dated March 2026) suggests this vulnerability has moved beyond discovery into the patching phase. The heap corruption impact is particularly concerning as it can lead to remote code execution, unauthorized information disclosure, or denial of service depending on exploitation sophistication. Cross-referencing with Debian's tracking of nine affected releases indicates this is not an isolated edge case but rather affects a substantial portion of the Linux ecosystem relying on Chromium-based browsers. The existence of official vendor documentation and patch availability, combined with the technical severity, suggests this warrants immediate patching despite the absence of confirmed KEV status or public POC in this intelligence set.

An attacker registers or compromises a website and injects a maliciously crafted HTML page containing specially designed graphics rendering commands that trigger integer overflow calculations in Chrome's ANGLE library. When a user visits this page using a vulnerable version of Chrome on Windows, the renderer process attempts to allocate memory based on the overflowed integer value, resulting in insufficient buffer allocation. Subsequent graphics operations then write beyond the allocated heap buffer, corrupting adjacent memory structures and potentially enabling remote code execution in the context of the renderer process. The attack requires no user interaction beyond normal browsing, making it an effective vector for drive-by compromise of Windows Chrome users.