Chrome EUVD-2026-14678

The victim must open or visit a crafted HTML page in Google Chrome prior to version 146.0.7680.165. No authentication required. Remote attacker delivers malicious HTML containing out-of-bounds CSS code.

This vulnerability presents a moderate-to-high real-world risk despite the absence of a publicly disclosed CVSS vector and EPSS score. The attack vector is Network (AV:N) and requires no user interaction beyond visiting a malicious webpage, making it easily exploitable at scale. The attack complexity is likely Low (AC:L), as the attacker only needs to serve a crafted HTML page; no special privileges or authentication are required. The technical impact is Information Disclosure (C:H, I:N, A:N), allowing memory leaks but not code execution or system compromise. Chromium's High severity classification aligns with the exploitability: this is a remote, zero-interaction vulnerability that can leak sensitive information. The absence of reported active exploitation (KEV status unknown from provided data) and lack of public proof-of-concept code reduce immediate threat, but the ease of weaponization and broad Chrome user base (billions of users) warrant prompt patching. Organizations should prioritize this as a medium priority for patch deployment within 30 days, higher for high-value targets or users in environments where memory contents may contain secrets.

An attacker hosts a malicious website containing a crafted HTML page with specially-formatted CSS rules designed to trigger an out-of-bounds read in Chrome's CSS parser. When a victim visits the site (through phishing, watering hole, or organic discovery), the browser automatically parses the malicious CSS, causing the parser to read memory beyond the intended buffer boundaries. The attacker can then exfiltrate the leaked memory contents via JavaScript to reveal heap layout information, encryption keys, or other sensitive data stored in the Chrome process memory. Since the attack requires only network delivery of a webpage and no user interaction beyond browsing, it is practical for mass exploitation campaigns targeting Chrome users.