Chrome CVE-2026-4459

The victim must open a crafted HTML page in Google Chrome versions prior to 146.0.7680.153. No special browser configuration required; WebAudio is enabled by default. Remote unauthenticated attacker delivers the malicious HTML via email, website, or messaging.

This vulnerability presents a high real-world risk despite missing CVSS and EPSS scores in the provided data. The Chromium security team's High severity classification, combined with the out-of-bounds read/write nature (which directly enables heap corruption exploitation), indicates a technically exploitable flaw with meaningful impact potential. The attack vector is network-based (requires only HTML delivery) and complexity is likely low (crafted HTML page, not user interaction required beyond visiting a page). The fact that a patch has been released and tracked across multiple Debian releases (9 releases noted) suggests active vendor engagement and recognized severity. Absence of KEV or POC data in the provided intelligence does not diminish risk—WebAudio vulnerabilities targeting heap corruption are frequently exploitable for sandbox escape or RCE. This should be treated as a high-priority patching target, particularly for systems exposed to untrusted web content.

An attacker hosts a malicious webpage containing crafted HTML and JavaScript that triggers specific WebAudio API calls designed to cause out-of-bounds memory access during audio buffer processing. When a victim visits the page in vulnerable Chrome (prior to 146.0.7680.153), the crafted audio configuration causes the WebAudio engine to read from or write to memory outside allocated heap boundaries, corrupting heap metadata or adjacent objects. This memory corruption can be leveraged to achieve information disclosure (via out-of-bounds read) or to hijack control flow (via out-of-bounds write), potentially breaking out of the Chrome sandbox to gain system-level code execution. No user interaction beyond visiting the page is required.