Chrome EUVD-2026-13453

The victim must open a crafted HTML page in Google Chrome prior to version 146.0.7680.153. No authentication required. Remote attacker delivers malicious HTML; victim interaction (opening page) is mandatory. WebAudio processing triggers heap buffer overflow.

This vulnerability presents elevated real-world risk despite missing CVSS and EPSS scores. Multiple signals converge to suggest high priority: the vendor has classified it as High severity from Chromium's own assessment, it achieves arbitrary code execution (complete technical impact), the attack vector is network-based and requires no user privileges beyond visiting a malicious webpage (low complexity), and it affects a ubiquitous browser used by billions globally. The attack is automatable—no user interaction beyond rendering an HTML page is required beyond the malicious webpage visit itself. The fact that a patch is available and tracked in ENISA EUVD (EUVD-2026-13453) further confirms vendor recognition of the severity. The absence of KEV/CISA known exploited vulnerability designation in the provided data does not diminish risk; it likely reflects recent disclosure. Organizations should treat this as critical-priority for patching, as the combination of RCE capability, network attack vector, and automation potential aligns with SSVC 'Scheduled' or 'Out-of-Cycle Emergency' remediation timelines.

An attacker crafts a malicious HTML page containing specially formatted WebAudio API calls or embedded audio data that triggers the heap buffer overflow when processed by Chrome's WebAudio engine. When a user visits this page (via phishing, drive-by download, or advertisement injection), the overflow corrupts heap memory, allowing the attacker to overwrite function pointers or other critical structures and execute arbitrary code within the Chrome sandbox. While sandbox escapes add additional complexity, code execution within the sandbox itself enables data theft, credential harvesting, or lateral movement to system processes—a realistic post-compromise scenario requiring no user interaction beyond page rendering.