Chrome EUVD-2026-13451

The victim must open a crafted HTML page in Google Chrome versions prior to 146.0.7680.153. Remote unauthenticated attacker sends malicious HTML triggering heap buffer overflow in CSS parser. No special browser configuration required; default Chrome installations vulnerable.

The real-world risk is substantial despite missing CVSS and EPSS numeric scores. Key risk signals include: (1) Chromium classified this as High severity, reflecting confidence in exploitation potential; (2) the attack vector is Network (unauthenticated remote delivery via HTML/CSS), making exploitation trivially accessible; (3) heap corruption vulnerabilities are historically leveraged for sandbox escapes and code execution in browsers; (4) patch availability confirms the vendor validated exploitability; (5) Debian tracking 9 releases indicates broad ecosystem impact. The absence of CVSS/EPSS data is unusual but does not diminish risk—High-severity heap overflows in rendering engines are consistently exploited in real-world campaigns. The attack complexity is likely Low given that CSS parsing is automatic and requires only convincing a user to visit a webpage. This should be treated as a critical priority for patching, particularly in enterprise environments where browser-based threat vectors are significant.

An attacker crafts a malicious HTML page containing adversarially designed CSS that triggers improper buffer bounds handling in Chrome's CSS parser, causing a heap buffer overflow. When a user visits the attacker's website or opens an HTML email attachment, the browser automatically processes the malicious CSS, corrupting the heap and potentially allowing the attacker to overwrite function pointers or other critical data structures. Depending on heap layout and exploit sophistication, this could enable sandbox escape and execution of arbitrary code with the privileges of the Chrome process, allowing credential theft, malware installation, or lateral movement within a network.