Chrome EUVD-2026-13480

The victim must open a crafted HTML page in Google Chrome versions prior to 146.0.7680.153. Remote unauthenticated attacker delivery via link or website. WebRTC functionality is enabled in default Chrome configuration.

The vulnerability presents significant real-world risk based on multiple threat indicators. While a CVSS vector string is not provided in the advisory data, Chromium's designation of High security severity indicates a network-based attack vector requiring no user privileges and likely moderate to low complexity. The heap buffer overflow nature of the defect is typically automatable via exploit frameworks once the specific memory layout is understood. The availability of a public Chromium issue tracker reference (issues.chromium.org/issues/491358681) and official Google patch release suggest active exploitation potential or imminent public disclosure. The broad affected population—Chrome is globally distributed—combined with the technical impact of heap corruption elevates this beyond a theoretical risk; exploitation likelihood is moderate to high. The fact that nine Debian releases are tracked indicates downstream distribution concern, amplifying exposure across Linux ecosystems.

An attacker hosts a malicious website containing specially crafted HTML and WebRTC JavaScript that triggers the heap buffer overflow when a user visits the page. Upon loading, the vulnerability in Chrome's WebRTC engine is triggered during buffer processing, causing heap corruption that can be leveraged to overwrite function pointers or other critical heap metadata. If the attacker has reverse-engineered the heap layout and exploit primitives, they may achieve arbitrary code execution in the browser process, leading to credential theft, malware installation, or lateral movement to the system. The attack requires only that the victim visit the malicious site—no user interaction beyond normal browsing is needed—making it highly practical for drive-by exploitation campaigns.