Chrome CVE-2026-4462

The victim must open a crafted HTML page in Google Chrome versions prior to 146.0.7680.153. Remote unauthenticated attacker can deliver via malicious website or email link. No special Chrome configuration required; default installations are vulnerable.

While CVSS score and vector data are not provided, the Chromium security classification of 'High' and the CWE-125 designation indicate significant real-world risk. The attack vector is network-based (via crafted HTML pages), attack complexity is low (standard web delivery), and no user privileges are required—making this trivial to exploit at scale. The vulnerability enables information disclosure, potentially leaking sensitive data from the renderer process memory (encryption keys, authentication tokens, browsing history). The absence of CVSS data and EPSS metrics limits quantitative risk scoring, but the combination of high vendor severity, low attack complexity, widespread Debian tracking, and availability of vendor patches suggests this is a genuine priority requiring rapid patching rather than a low-real-risk high-CVSS case. The patch's public availability and advisory presence indicate coordinated disclosure without evidence of active wild exploitation at announcement time.

An attacker hosts a malicious website containing crafted HTML markup that triggers the out of bounds read in Blink's buffer handling logic. When a victim visits the site using a vulnerable Chrome version, the renderer process reads memory beyond intended buffer boundaries, exfiltrating sensitive data (e.g., cached credentials, cryptographic material) back to the attacker's server via WebSocket or fetch API calls. No user interaction beyond page load is required, and the low attack complexity means the exploit can be delivered at scale through ad networks, compromised legitimate websites, or spear-phishing campaigns. The vulnerability's information disclosure nature makes it particularly valuable as a reconnaissance vector for multi-stage attacks targeting Chrome's sandbox or system-level exploits.