Chrome EUVD-2026-13481

The victim must visit or be redirected to a crafted HTML page in Google Chrome versions prior to 146.0.7680.153. No authentication required. Exploitation is remote but requires user interaction (visiting the malicious page).

While CVSS and EPSS scores are not provided in the available data, the Medium severity designation from Chromium's security team, combined with the remote attack vector (no user interaction required beyond visiting a webpage) and the nature of heap corruption, indicates a meaningful exploitation risk. The integer overflow is likely automatable once discovered—an attacker need only craft a single HTML/WebGL payload and serve it broadly. The lack of privilege elevation requirements and the widespread deployment of Chrome across consumer and enterprise environments elevate real-world risk. However, the Medium (not High/Critical) severity suggests exploitation complexity or limited impact scope. KEV and POC availability are not explicitly confirmed in the provided intelligence; however, the existence of a public bug tracker reference (issues.chromium.org/issues/487208468) suggests the flaw may be semi-public. The availability of a stable patch reduces urgency for advanced threat actors but increases responsibility for defenders to deploy the update.

An attacker hosts a seemingly benign website or injects malicious scripts into a compromised legitimate site. When a Chrome user visits this page, JavaScript constructs a carefully crafted WebGL shader or canvas context that triggers the integer overflow in ANGLE's graphics pipeline. The overflow corrupts an adjacent heap structure, allowing the attacker to overwrite critical memory such as function pointers or object metadata. In a realistic scenario, this could facilitate arbitrary code execution within the Chrome renderer process sandbox, potentially leading to data exfiltration or installation of additional payloads. No special user interaction (such as clicking a button) is required; the exploit triggers automatically upon page load.