CVE-2026-1861
Published: 03 February 2026
Summary
CVE-2026-1861 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-1861 is a heap buffer overflow vulnerability in the libvpx component of Google Chrome prior to version 144.0.7559.132. The flaw enables a remote attacker to potentially exploit heap corruption via a crafted HTML page. It maps to CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Chromium security severity rated as High.
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or opening a crafted HTML page, requiring no privileges or special access. Exploitation could lead to high-impact consequences, including unauthorized disclosure of information, modification of data, and disruption of system availability through heap corruption, potentially enabling arbitrary code execution within the browser's sandbox.
Google has addressed the issue in Chrome stable channel version 144.0.7559.132 and later, as announced in the Chrome Releases blog post (https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop.html). Further technical details are available in the associated Chromium issue tracker entry (https://issues.chromium.org/issues/478942410). Security practitioners should prioritize updating affected Chrome installations to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5160
Vulnerability details
Heap buffer overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in Chrome's libvpx enables drive-by compromise via crafted HTML page (T1189) and direct exploitation for client-side code execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and patching of flaws like the heap buffer overflow in libvpx, directly mitigating the vulnerability through software updates to Chrome 144.0.7559.132 or later.
Implements memory protection safeguards such as ASLR and DEP to prevent unauthorized code execution from heap corruption caused by the buffer overflow.
Enforces process isolation via browser sandboxing to limit the impact of heap corruption exploits within the Chrome renderer process.