What is the CVSS score of CVE-2026-4457?

CVE-2026-4457 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ubuntu are affected by CVE-2026-4457?

Organizations using V8 in Google Chrome face significant risk from CVE-2026-4457 rated CVSS 8.8.. A patch is available.

How to fix or mitigate CVE-2026-4457?

Within 7 days: Identify all affected systems running V8 in Google Chrome and apply vendor patches promptly. Vendor patch is available.

Ubuntu CVE-2026-4457

EUVD-2026-13474 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-03-20 chrome-cve-admin@google.com

Google Memory Corruption Information Disclosure Ubuntu Debian Chrome Red Hat Suse

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Ubuntu

MEDIUM

qualitative

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 20, 2026 - 08:46 nvd

Patch available

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13474

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 02:16 nvd

HIGH 8.8

DescriptionCVE.org

Type Confusion in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap memory corruption in Google Chrome's V8 engine (versions prior to 146.0.7680.153) stems from type confusion vulnerabilities that can be triggered through malicious HTML pages without user privileges. An unauthenticated remote attacker can exploit this to achieve arbitrary code execution or crash the browser. The vulnerability affects Chrome, Ubuntu, and Debian systems, with patches now available.

Technical ContextAI

This vulnerability resides in V8, Google's JavaScript execution engine integrated into Chromium-based browsers. Type confusion vulnerabilities (CWE-843) occur when code incorrectly interprets data as a different type than its actual type, leading to type safety violations. In V8's context, this flaw allows an attacker to confuse the JavaScript engine's type system, potentially causing it to misinterpret heap-allocated objects and execute unintended operations on memory. The vulnerability is exploitable via malicious HTML/JavaScript served through standard web browsing, making the attack vector network-based and requiring only user interaction (visiting a webpage). The affected product is Google Chrome (Chromium project), with confirmed impact on Chrome 146.0.7680.152 and earlier versions, as well as Debian packages tracking Chrome across 9 releases.

RemediationAI

Immediately upgrade Google Chrome to version 146.0.7680.153 or later by navigating to Settings > About Chrome, which will trigger automatic download and installation of the latest stable build. For Debian-based systems, update the chromium or chromium-browser package via apt-get update && apt-get upgrade chromium-browser to obtain patched versions corresponding to Chrome 146.0.7680.153. Until patching can be completed, consider restricting access to untrusted websites and disabling JavaScript execution in less-critical browser contexts where feasible. Enterprise deployments should enforce automatic Chrome updates via Group Policy (Windows) or Mobile Device Management (macOS/Linux) to ensure rapid patch deployment. Verify remediation by confirming Chrome version in Settings > About Chrome displays 146.0.7680.153 or higher. Refer to the official Chrome security update advisory at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html for additional details.

More in Chrome

View all

CVE-2015-5122 CRITICAL Emergency POC

9.8 Jul 14

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player

CVE-2016-5198 HIGH Act Now POC

8.8 Jan 19

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac

CVE-2017-5070 HIGH Act Now POC

8.8 Oct 27

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a

CVE-2016-1646 HIGH Act Now POC

8.8 Mar 29

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do

CVE-2013-0758 CRITICAL Emergency POC

9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb

CVE-2017-5030 HIGH Act Now POC

8.8 Apr 24

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.

CVE-2012-3993 CRITICAL Emergency POC

9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi

CVE-2017-3823 HIGH Act Now POC

8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta

CVE-2014-8636 HIGH Act Now POC

7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL Emergency POC

9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi

CVE-2014-1510 CRITICAL Emergency POC

9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se

CVE-2015-5123 CRITICAL Emergency

9.8 Jul 14

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

View all

CVE-2011-0611 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2017-8291 HIGH POC

7.8

CVE-2016-7201 HIGH POC

8.8

CVE-2017-0037 HIGH POC

8.1

CVE-2017-5070 HIGH POC

8.8

CVE-2025-30397 HIGH POC

7.5

CVE-2016-0985 HIGH POC

8.8

Same technique Memory Corruption

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2010-3333 HIGH POC

7.8

Vendor StatusVendor

Ubuntu

Priority: Medium

chromium-browser

Release	Status	Version
jammy	not-affected	code not present
noble	not-affected	code not present
questing	not-affected	code not present
upstream	released	-

Debian

chromium

Release	Status	Fixed Version	Urgency
bullseye (security), bullseye	vulnerable	120.0.6099.224-1~deb11u1	-
bookworm	fixed	146.0.7680.153-1~deb12u1	-
bookworm (security)	fixed	146.0.7680.153-1~deb12u1	-
trixie	fixed	146.0.7680.153-1~deb13u1	-
trixie (security)	fixed	146.0.7680.153-1~deb13u1	-
forky	vulnerable	146.0.7680.80-1	-
sid	fixed	146.0.7680.153-1	-
bullseye	fixed	(unfixed)	end-of-life
(unstable)	fixed	146.0.7680.153-1	-

DSA-6171-1

SUSE

Severity: High

Product	Status
SUSE Package Hub 15 SP6	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Package Hub 15 SP6	Fixed

CVE-2026-4457 vulnerability details – vuln.today

Back

Ubuntu CVE-2026-4457

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Chrome

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

Same technique Memory Corruption

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code