Chrome EUVD-2026-14680

The victim must open a crafted HTML page in Google Chrome versions prior to 146.0.7680.165. Remote attacker requires no authentication. WebGL must be enabled (default configuration). Victim interaction required: opening/viewing the malicious webpage.

This vulnerability carries High chromium security severity and represents significant real-world risk despite missing CVSS and EPSS scores. The attack vector is Network with likely Low complexity (requires only crafted HTML), indicating broad exploitability. The technical impact permits out-of-bounds memory reads, enabling information disclosure attacks that could leak credentials, session tokens, or other sensitive data from browser memory. The absence of privilege requirement escalates risk considerably. While KEV status and active exploitation data are not provided in the intelligence sources, the High severity classification from Google's security team, combined with the public disclosure via Chrome Releases and Chromium bug tracker, suggests this is a prioritized vulnerability. The memory read capability (rather than write) slightly reduces immediate risk of remote code execution, but information disclosure from browser memory remains a critical security concern. Real-world priority is HIGH due to the large Chrome user base and the ease of delivering the exploit payload via web browsing.

An attacker creates a malicious website containing WebGL code that triggers the heap buffer overflow by sending crafted graphics commands that exceed allocated buffer boundaries. When a Chrome user visits this website, the browser's renderer process executes the WebGL payload, allowing the attacker to read sensitive data from the process heap—such as cached login tokens, session data, or other in-memory secrets. The attack requires only that the victim visit the webpage and have WebGL enabled (default in modern Chrome), with no additional user interaction or privilege escalation necessary. The attacker could distribute this malicious page via social engineering, watering hole attacks, or compromised advertising networks to target specific users or conduct mass information harvesting.