Chrome CVE-2026-4680

The victim must visit a crafted HTML page in Google Chrome versions prior to 146.0.7680.165. FedCM (Federated Credential Management) must be functional. Remote unauthenticated attacker; user interaction (visiting the page) required.

This vulnerability represents a critical real-world risk due to multiple compounding factors. Although no CVSS vector is published, the Chromium security team assigned it High severity, indicating substantial exploitability and impact. The attack vector is network-based (remote HTML page delivery) with low complexity, requiring only user visit to a malicious website—no authentication or special privileges needed. The technical impact is severe: arbitrary code execution within the Chrome sandbox, which while isolated from the OS, can still compromise user data, extensions, and credentials. The use-after-free class (CWE-416) is known to have readily available exploitation techniques, and the fact that a specific Chromium issue (491869946) was filed suggests active development and potential PoC existence within security communities. The patch availability in Chrome 146.0.7680.165 and later is critical—older versions remain vulnerable. Given the ubiquity of Chrome and the immediacy of the threat vector, this should be treated as a high-priority patch deployment regardless of the absence of formal CVSS metrics or EPSS scoring.

An attacker crafts a malicious HTML page containing FedCM-specific elements (e.g., a config URL or credential request) that triggers the use-after-free condition during the identity federation flow. When a victim visits this page in Chrome, the browser processes the FedCM request, causing a freed memory region to be accessed and corrupted. The attacker can manipulate the freed memory layout to gain control of execution, executing arbitrary code within the Chrome sandbox process. This could be leveraged to steal cached credentials, inject malicious scripts into trusted sites, or perform further browser-based attacks. No active in-the-wild exploitation has been publicly reported at the time of the CVE disclosure, but the low barrier to exploitation (network-only attack vector, standard web technologies) makes this a high-priority patch.