What is the CVSS score of CVE-2026-4462?

CVE-2026-4462 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ubuntu are affected by CVE-2026-4462?

Organizations using Blink in Google Chrome face significant risk from CVE-2026-4462, a out-of-bounds read vulnerability rated CVSS 8.8.. A patch is available.

How to fix or mitigate CVE-2026-4462?

Within 7 days: Identify all affected systems running Blink in Google Chrome and apply vendor patches promptly. Vendor patch is available.

Ubuntu CVE-2026-4462

EUVD-2026-13479 HIGH

Out-of-bounds Read (CWE-125)

2026-03-20 chrome-cve-admin@google.com

Google Buffer Overflow Information Disclosure Ubuntu Debian Chrome Red Hat Suse

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Ubuntu

MEDIUM

qualitative

SUSE

HIGH

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 20, 2026 - 08:46 nvd

Patch available

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13479

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 02:16 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds read in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

An out of bounds read vulnerability exists in the Blink rendering engine of Google Chrome prior to version 146.0.7680.153, allowing remote attackers to read memory outside intended buffer boundaries via a specially crafted HTML page. This vulnerability (CWE-125) has been classified as High severity by the Chromium security team and enables information disclosure attacks without requiring user interaction beyond visiting a malicious webpage. A vendor patch is available, and the vulnerability affects 9 Debian releases, indicating widespread downstream impact across Linux distributions.

Technical ContextAI

The vulnerability resides in Blink, Google Chrome's open-source web rendering engine derived from WebKit, which is responsible for parsing and rendering HTML, CSS, and executing JavaScript. CWE-125 (Out-of-bounds Read) indicates that the vulnerability occurs when the Blink parser or related memory-handling code fails to properly validate buffer boundaries, permitting an attacker to read adjacent memory regions beyond the allocated buffer. The affected component processes untrusted HTML input directly from web pages, making the attack surface trivial to reach. The vulnerability was discovered through Chromium's issue tracker (issues.chromium.org/issues/491080830) and impacts the stable release channel across Windows, macOS, and Linux platforms.

RemediationAI

Immediately upgrade Google Chrome to version 146.0.7680.153 or later via the built-in auto-update mechanism (Settings > About > Google Chrome) or manual download from https://www.google.com/chrome/. For Debian-based systems, update the chromium or google-chrome package using apt-get update && apt-get install google-chrome-stable or equivalent package manager commands once security updates are released to the Debian repositories. Until patching is feasible in constrained environments, restrict browser usage to trusted websites only, disable JavaScript execution for untrusted content via browser extensions (uBlock Origin, NoScript), and enforce Content Security Policy (CSP) headers on internal applications to limit attack surface. Consider deploying sandboxing solutions or containerized browser environments for high-risk user populations.

More in Chrome

View all

CVE-2015-5122 CRITICAL Emergency POC

9.8 Jul 14

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player

CVE-2016-5198 HIGH Act Now POC

8.8 Jan 19

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac

CVE-2017-5070 HIGH Act Now POC

8.8 Oct 27

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a

CVE-2016-1646 HIGH Act Now POC

8.8 Mar 29

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do

CVE-2013-0758 CRITICAL Emergency POC

9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb

CVE-2017-5030 HIGH Act Now POC

8.8 Apr 24

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.

CVE-2012-3993 CRITICAL Emergency POC

9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi

CVE-2017-3823 HIGH Act Now POC

8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta

CVE-2014-8636 HIGH Act Now POC

7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL Emergency POC

9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi

CVE-2014-1510 CRITICAL Emergency POC

9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se

CVE-2015-5123 CRITICAL Emergency

9.8 Jul 14

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2016-1646 HIGH POC

8.8

CVE-2025-5777 HIGH POC

7.5

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2017-11882 HIGH POC

7.8

CVE-2010-3333 HIGH POC

7.8

Vendor StatusVendor

Ubuntu

Priority: Medium

chromium-browser

Release	Status	Version
jammy	not-affected	code not present
noble	not-affected	code not present
questing	not-affected	code not present
upstream	released	-

Debian

chromium

Release	Status	Fixed Version	Urgency
bullseye (security), bullseye	vulnerable	120.0.6099.224-1~deb11u1	-
bookworm	fixed	146.0.7680.153-1~deb12u1	-
bookworm (security)	fixed	146.0.7680.153-1~deb12u1	-
trixie	fixed	146.0.7680.153-1~deb13u1	-
trixie (security)	fixed	146.0.7680.153-1~deb13u1	-
forky	vulnerable	146.0.7680.80-1	-
sid	fixed	146.0.7680.153-1	-
bullseye	fixed	(unfixed)	end-of-life
(unstable)	fixed	146.0.7680.153-1	-

DSA-6171-1

SUSE

Severity: High

Product	Status
SUSE Package Hub 15 SP6	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Package Hub 15 SP6	Fixed

CVE-2026-4462 vulnerability details – vuln.today

Back

Ubuntu CVE-2026-4462

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Chrome

Same weakness CWE-125 – Out-of-bounds Read

Same technique Buffer Overflow

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code