Chrome CVE-2026-4461

Victim must open a crafted HTML page in Google Chrome prior to version 146.0.7680.153. Remote unauthenticated attacker delivers malicious HTML (e.g., via email, malicious website, or compromised page). No special Chrome configuration required—vulnerability affects default installations.

Although CVSS score and vector are not provided, the Chromium project's assignment of 'High' security severity and the nature of heap corruption exploitation indicate substantial real-world risk. The attack vector is network-based (user visits malicious webpage), complexity is likely medium to low given that proof-of-concept details exist in the referenced Chromium issue tracker (issues.chromium.org/issues/490558172), and no authentication is required. The presence of a vendor patch and documentation in the Chrome stable channel release notes (March 2026) indicates this was actively being exploited or had demonstrated exploitability before patching. Given the widespread deployment of Chrome and the remote, unauthenticated nature of the attack, this should be treated as a critical priority despite missing CVSS data. EPSS data is not available, but the combination of high Chromium severity, heap corruption mechanics, and network attack vector suggests exploitation probability is substantial.

An attacker crafts a malicious HTML page containing carefully constructed JavaScript that triggers heap corruption in V8's memory allocator or object representation. When a user visits this webpage in a vulnerable version of Chrome, the malicious code exploits the heap corruption to read or write arbitrary memory, potentially achieving heap-spray techniques to place and execute shellcode. The attack requires only that the user visit the attacker-controlled webpage—no user interaction beyond normal browsing is needed—making this a practical vector for drive-by attacks via compromised legitimate websites or malvertising campaigns.