Chrome CVE-2026-4454

The victim must open a crafted HTML page in Google Chrome versions prior to 146.0.7680.153. Remote unauthenticated attacker; requires user interaction (visiting malicious webpage). No special browser configuration required.

While CVSS and EPSS scores are not explicitly provided in the intelligence, the Chromium vendor severity rating of High indicates significant real-world risk. The attack vector is network-based (unauthenticated, remote exploitation via HTML page), and the complexity is described as allowing 'crafted' HTML—suggesting moderate but achievable attack complexity. The use-after-free in a network component typically results in memory corruption with deterministic exploitation potential, making this a high-priority issue. The availability of an official patch and tracking by multiple vulnerability databases (NVD, ENISA, Chromium issue tracker) indicates active development attention. The denial of service impact is confirmed, and heap corruption could enable more severe outcomes. This should be treated as a high-priority vulnerability due to the remote attack vector, lack of authentication requirements, and presence of an active patch.

An attacker creates a malicious website containing specially crafted HTML and JavaScript that triggers improper memory management in Chrome's Network subsystem during page load. When a victim visits the site in a vulnerable Chrome version, the crafted payload causes a heap-allocated network buffer or connection object to be freed while still referenced elsewhere in the code. Subsequent operations attempt to access this freed memory, causing heap corruption that can crash the browser (denial of service) or potentially be leveraged for code execution. No public proof-of-concept is referenced in the provided intelligence, but the specificity of the Chromium issue identifier (488585488) suggests an internally tracked exploit or crash case that prompted the High severity classification.