Chrome CVE-2026-4460

The victim must open a crafted HTML page in Google Chrome versions prior to 146.0.7680.153. Remote attacker sends malicious webpage; no authentication or special configuration required. User interaction (opening the page) is mandatory.

While the Chromium security team assigned High severity classification, the real-world risk requires nuanced assessment across multiple signals. The vulnerability is network-accessible (CVSS Attack Vector: Network) with low attack complexity, requiring only a user visit to a malicious webpage—no user-assisted exploitation needed beyond clicking a link. The absence of CVSS numerical score and EPSS probability data limits quantitative risk modeling, but the information disclosure nature (memory read, not code execution) represents a lower impact tier than remote code execution vulnerabilities. A patch is available and stable version 146.0.7680.153 has been released, reducing active exploitation window. The vulnerability does not appear on known exploit databases or KEV catalogs at this time, suggesting limited current weaponization. However, memory disclosure vulnerabilities are often chained with other flaws for sandbox escape, making this a genuine secondary risk component in sophisticated attacks. Priority should be driven by organizational Chrome deployment scale rather than standalone CVSS rating.

An attacker creates a malicious website containing crafted SVG or WebGL content designed to trigger the out-of-bounds read in Skia's rendering pipeline. When a user visits the site, Chrome automatically renders the malicious graphics, causing the Skia library to read memory outside buffer bounds. The attacker captures the leaked memory contents, which may contain credentials, encryption keys, or data from other browser tabs. This information disclosure could enable follow-up attacks such as session hijacking or sandbox escape if combined with additional vulnerabilities. No public proof-of-concept is currently documented, but the attack requires no interaction beyond visiting the webpage.