Chrome CVE-2026-4458

The victim must install a malicious Chrome extension in Google Chrome versions prior to 146.0.7680.153. Requires user interaction to install the extension. Attacker cannot exploit without first convincing the user to install the malicious extension.

The real-world risk profile is moderately elevated despite the absence of published CVSS and EPSS scores. The attack vector is 'local' (requires user interaction and extension installation) and the complexity is 'high' (requires a sophisticated malicious extension), which typically limits widespread automated exploitation. However, use-after-free bugs in memory-unsafe contexts like Chrome's native code are historically reliable exploitation vectors; once triggered, they frequently lead to information disclosure, denial of service, or code execution. The vulnerability is not yet in the KEV catalog and no public proof-of-concept has been disclosed, suggesting limited real-world exploitation at the time of patch release. The availability of a vendor patch (Chrome 146.0.7680.153 and later) significantly reduces risk for patched systems. For organizations with strict extension policies and automatic Chrome updates, this represents a lower priority; for systems allowing arbitrary extension installation or running older Chrome versions, the risk is material and should be addressed promptly.

An attacker creates a malicious Chrome extension that appears to provide a legitimate function (e.g., a password manager or productivity tool) and distributes it through social engineering, email, or compromised forums. When a user installs the extension, the malicious code within it triggers the use-after-free condition in the Chrome Extensions API by making a carefully crafted sequence of calls that cause Chrome to dereference freed heap memory. This results in either a crash (denial of service) or, with further sophistication, memory corruption that could enable arbitrary code execution within the Chrome process context. No public proof-of-concept has been released, but the vulnerability does not require user interaction beyond the initial installation decision, making it a practical attack vector for targeted campaigns against specific users.