Chrome EUVD-2026-14676

Victim must open a crafted HTML page in Google Chrome prior to version 146.0.7680.165. Remote unauthenticated attacker delivers malicious page via email, website, or social engineering. No special browser configuration required; default installations vulnerable.

While CVSS score and vector data are not provided in the vulnerability record, the Chromium security team assigned this a High severity rating, indicating significant real-world risk. The attack vector is network-based (requires visiting a malicious webpage), and attack complexity is low once a page is loaded. No special user privileges are required beyond visiting a crafted HTML page. Given that this is a heap buffer overflow with arbitrary out-of-bounds write capability, the technical impact is severe (potential code execution or heap corruption leading to process crash). The vulnerability affects a widely-deployed browser with a massive user base. No EPSS score or KEV status is provided in the intelligence, but the High severity designation, the nature of heap overflows (typically exploitable for code execution), and the network attack vector suggest this represents a notable security priority. The patch availability (Chrome 146.0.7680.165+) mitigates risk for users who update promptly, but the broad user base means many systems remained vulnerable during the gap between discovery and patch release.

An attacker hosts a malicious website containing specially crafted HTML and JavaScript that triggers specific WebAudio API calls with out-of-bounds parameters. When a victim with an unpatched Chrome browser (prior to 146.0.7680.165) visits this website, the WebAudio processing code attempts to write audio data to a heap buffer without proper bounds validation, corrupting adjacent heap memory. Depending on the attacker's precision and heap layout, this can overwrite critical data structures or function pointers, potentially leading to arbitrary code execution in the context of the Chrome process. The attack requires no user interaction beyond visiting the webpage, and the low complexity makes this a significant practical threat until patching is deployed.