Chrome CVE-2026-4678

The victim must open a crafted HTML page in Google Chrome prior to version 146.0.7680.165. WebGPU support must be enabled (default in Chrome). Remote attacker requires no authentication or special privileges. Arbitrary code execution is sandboxed.

This vulnerability presents high real-world risk despite missing CVSS and EPSS scores. The attack vector is network-based (remote HTML delivery), requires no user privilege escalation, and while it occurs within a sandbox, successful exploitation yields arbitrary code execution with renderer process privileges—sufficient to bypass same-origin policy and exfiltrate sensitive data. The High severity rating from Chromium's security team (a trusted source with deep codebase knowledge) indicates exploitability is likely demonstrable. The existence of a public Chromium issue tracker reference (issues.chromium.org/issues/491164019) and the tied stable channel release (March 2026) suggest coordinated disclosure and patch availability. Without EPSS data or confirmed KEV listing, assume this requires active targeting but is not yet mass-exploited; however, memory corruption vulnerabilities in widely-used browsers are historically high-priority for adversaries. Immediate patching is justified.

An attacker hosts a malicious website containing crafted WebGPU initialization code that triggers a use-after-free condition in Chrome's graphics memory management. When a user visits this site (or is redirected to it via a compromised ad network), the malicious JavaScript executes within the renderer process sandbox. The exploit frees a graphics buffer object prematurely and then performs operations that access the freed memory, allowing arbitrary code execution within the sandboxed context. From there, the attacker can steal session cookies, exfiltrate form data, perform keylogging, or pivot to secondary exploits that break out of the sandbox entirely. No user interaction beyond visiting the page is required, and the complexity is low given that the vulnerability lies in the graphics stack itself rather than requiring special user permissions.