Chrome EUVD-2026-14686

The victim must open a crafted HTML page in Google Chrome versions prior to 146.0.7680.165. Remote unauthenticated attacker delivery via email, malicious website, or social engineering. No special Chrome configuration required—affects default installations.

Despite the absence of a published CVSS vector and score in the initial reporting, this vulnerability represents a high real-world risk based on multiple converging signals. The Chromium security team assigned a High severity rating, indicating that exploitation results in significant technical impact (arbitrary memory write). The attack vector is Network (remote exploitation via HTML), and no special privileges or user interaction beyond visiting a webpage is required, suggesting low attack complexity. The vulnerability affects a ubiquitous client-side application (Google Chrome) used by billions of users worldwide. Although no CVSS score or EPSS probability is provided in the intelligence, the absence of these metrics does not diminish risk; rather, the High severity designation combined with the out-of-bounds write capability (enabling code execution or information disclosure paths) indicates this should be prioritized for patching immediately upon release. The fact that a specific patch version (146.0.7680.165) was released indicates the vulnerability was confirmed and fixed, suggesting either active in-the-wild exploitation pressure or proactive disclosure by Google's security team. Any organization with Chrome deployments should treat this as critical until updated.

An attacker crafts a malicious HTML page containing a specially constructed font file that triggers an integer overflow in Chrome's font parser. When a victim visits this webpage through any delivery vector (phishing email, compromised ad network, watering hole), Chrome loads and processes the font, causing the integer overflow to calculate an undersized buffer for font data storage. The attacker then supplies additional font data that overflows this undersized buffer, writing arbitrary values into adjacent memory regions. Depending on memory layout and the specific values written, this could enable code execution, information disclosure, or denial of service, representing a complete compromise of the browser sandbox and user system.