Chrome CVE-2026-4457

The victim must visit or be redirected to a crafted HTML page in Google Chrome versions prior to 146.0.7680.153. Remote unauthenticated attacker; no special browser configuration required. Requires user interaction (visiting the page).

The risk assessment combines multiple signals: (1) CVSS severity is rated High by Chromium, though specific CVSS vector data is unavailable in this report; (2) attack vector is network-based with low complexity, requiring only user interaction to visit a crafted webpage; (3) the vulnerability enables heap corruption and information disclosure, both technical impacts of high severity; (4) no KEV (Known Exploited Vulnerabilities) status, EPSS score, or public proof-of-concept has been reported, suggesting limited real-world exploitation at disclosure; (5) a vendor patch is available from Google, reducing operational risk for timely adopters. While the memory corruption potential is concerning and warrants priority, the absence of active exploitation evidence and availability of a prompt patch suggest this is a legitimate high-priority issue rather than an inflated scoring scenario. Organizations should treat this as a critical patch management priority, particularly for publicly exposed systems and high-value users.

An attacker crafts a malicious HTML page containing specially engineered JavaScript code that exploits the type confusion flaw in V8. When a victim visits this page in Chrome (prior to 146.0.7680.153), the JavaScript triggers the type confusion, causing the V8 engine to misinterpret a heap-allocated object's type and corrupt adjacent memory structures. This could allow the attacker to read sensitive data from the browser process's memory (information disclosure) or, in a more sophisticated attack, to achieve code execution by carefully controlling heap layout and overwriting function pointers or other critical data structures. The attack requires only the victim to visit a webpage, making it a practical threat for drive-by compromise scenarios.