Chrome EUVD-2026-13449

Victim must open a crafted HTML page in Google Chrome versions prior to 146.0.7680.153. Remote unauthenticated attacker can deliver the malicious page via email, website, or messaging. No special Chrome configuration required — affects default installations.

This vulnerability carries critical risk based on multiple converging signals: the vendor-assigned critical severity rating from Google, the CWE-416 classification (use-after-free in heap memory), and the remote attack vector via HTML content. The absence of a CVSS vector score and EPSS probability prevents quantified calculation, but the critical designation and heap corruption potential indicate high exploitability. The attack requires no user authentication or special privileges and has low complexity—a user merely needs to visit a malicious website. While no public proof-of-concept or KEV/CISA listing is apparent from the provided data, the availability of a vendor patch and the specificity of the Chromium issue tracker reference suggest active vendor awareness and priority remediation. From an SSVC perspective, this meets criteria for immediate patching: the technical impact is high (code execution/DoS), the exploitation likelihood is high given the attack vector and complexity rating, and the patch is readily available. Browser vendors typically see faster adoption of critical patches than enterprise software, but unpatched populations remain at risk until updates propagate.

An attacker hosts a malicious website containing a crafted HTML document that triggers a specific sequence of DOM operations or event handlers, causing the Base component to dereference a freed pointer during layout or rendering. When a victim visits this website using an unpatched Chrome browser, the heap corruption is triggered, resulting in either a denial-of-service crash or, with careful heap grooming, potential code execution with the privileges of the Chrome process. The attack requires only that the user click a link or visit the attacker's site; no additional user interaction or social engineering is needed beyond the initial visit.