EUVD-2026-13473Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted HTML page to user
-
DeliveryCompromise renderer process
-
ExploitTrigger use-after-free in Digital Credentials API
-
ExecutionEscape sandbox
-
ImpactExecute arbitrary code with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires Google Chrome versions prior to 146.0.7680.153 with compromised renderer process. Victim must open a crafted HTML page. Attacker needs prior renderer process compromise to achieve sandbox escape; not exploitable from default remote context alone. |
| Impact | While a CVSS score and vector are not explicitly provided, the Chromium security severity rating of 'High' and the nature of the vulnerability (sandbox escape from compromised renderer) indicate substantial real-world risk. The attack prerequisite—a compromised renderer process—is significant; this is not a direct remote code execution vulnerability but rather a secondary exploitation step. The availability of a vendor patch and absence of public proof-of-concept or active exploitation in the KEV catalog suggest this is not yet a critical priority, but organizations should treat this as a medium-to-high priority for timely patching given the sandbox escape capability and presence in multiple Debian releases. The technical impact (sandbox escape) is severe even if exploitation probability is conditional on prior renderer compromise. |
| Exploit ScenarioDerived | An attacker who has successfully compromised the Chrome renderer process (e.g., via a prior vulnerability or malicious script injection) crafts a specially designed HTML page containing calls to the Digital Credentials API that trigger the use-after-free condition. When the compromised renderer executes this HTML, the freed memory in the API handler is manipulated to corrupt internal browser structures, allowing the attacker to break out of the sandbox and execute arbitrary code at the privilege level of the Chrome process, potentially leading to full system compromise depending on the user's privilege level. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
A use-after-free vulnerability in Google Chrome's Digital Credentials API prior to version 146.0.7680.153 enables attackers with a compromised renderer process to escape the sandbox and potentially achieve code execution through a specially crafted HTML page. The vulnerability affects Chrome on multiple platforms including Ubuntu and Debian systems, requiring user interaction to trigger but presenting high impact across confidentiality, integrity, and availability. A patch is available in Chrome 146.0.7680.153 and later versions.
Earlier versions of this analysis (1)
A use-after-free vulnerability exists in Google Chrome's Digital Credentials API that allows a remote attacker who has already compromised the renderer process to escape the sandbox via a crafted HTML page. This vulnerability affects Chrome versions prior to 146.0.7680.153 and is classified as high severity by Chromium's security team. A patch is available from the vendor, though no public exploitation activity or proof-of-concept has been reported in the provided intelligence sources.
RemediationAI
Users should upgrade Google Chrome to version 146.0.7680.153 or later immediately. On Debian systems, users should check for updated Chrome packages from Debian security advisories (ENISA EUVD-2026-13473) or install the latest version directly from Google's official Chrome downloads. Given the sandbox escape severity, no effective workaround exists short of patching; however, organizations may temporarily mitigate risk by disabling the Digital Credentials API via enterprise policy (chrome://policy) if available in their deployment, though this is not recommended as a long-term solution. Refer to the vendor advisory at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html for patch download links and https://nvd.nist.gov/vuln/detail/CVE-2026-4456 for additional guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-416 (Use After Free), a memory corruption weakness where the Digital Credentials API in Chrome fails to properly manage object lifecycle within the renderer process. The Digital Credentials API is a web platform feature that handles secure credential operations. When memory is freed but subsequently accessed by the API logic, an attacker can manipulate this freed memory region to achieve sandbox escape—the most critical impact in a multi-process browser architecture. The vulnerability requires an already-compromised renderer process as the entry point, making this a privilege escalation issue within the browser's security model rather than a direct remote code execution from an untrusted webpage.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Digital Credentials API in Google Chrome prior to 146.0.7680.153 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Organizations using Digital Credentials API in Google Chrome face significant risk from CVE-2026-4456, a use-after-free vulnerability rated CVSS 8.8. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome 146.0.7680.153 Memory Corruption
View all 26Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| jammy | not-affected | code not present |
| noble | not-affected | code not present |
| questing | not-affected | code not present |
| upstream | released | - |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye (security), bullseye | vulnerable | 120.0.6099.224-1~deb11u1 | - |
| bookworm | fixed | 146.0.7680.153-1~deb12u1 | - |
| bookworm (security) | fixed | 146.0.7680.153-1~deb12u1 | - |
| trixie | fixed | 146.0.7680.153-1~deb13u1 | - |
| trixie (security) | fixed | 146.0.7680.153-1~deb13u1 | - |
| forky | vulnerable | 146.0.7680.80-1 | - |
| sid | fixed | 146.0.7680.153-1 | - |
| bullseye | fixed | (unfixed) | end-of-life |
| (unstable) | fixed | 146.0.7680.153-1 | - |
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP6 | Fixed |
GitHub PoC
Exploit-DB