CVE-2026-4439
Published: 20 March 2026
Summary
CVE-2026-4439 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 25.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-4439 is an out-of-bounds memory access vulnerability (CWE-125, CWE-787) in the WebGL component of Google Chrome on Android versions prior to 146.0.7680.153. Published on 2026-03-20, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is classified as Critical by Chromium security.
A remote attacker can exploit this issue by luring a user to interact with a crafted HTML page, requiring no privileges but necessitating user interaction such as loading the malicious content in a browser. Successful exploitation enables a potential sandbox escape, granting high-impact access to confidentiality, integrity, and availability within the affected browser context.
Google has released Chrome for Android version 146.0.7680.153 to patch this vulnerability. Security practitioners should prioritize updating affected devices. Additional details are available in the Chrome Releases stable channel update at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html and the Chromium issue tracker at https://issues.chromium.org/issues/475877320.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13445
Vulnerability details
Out of bounds memory access in WebGL in Google Chrome on Android prior to 146.0.7680.153 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds memory corruption in Chrome WebGL enables remote code execution (with sandbox escape) when a user visits a crafted HTML page, directly mapping to Drive-by Compromise (T1189).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates identification, reporting, and timely remediation of critical flaws like the WebGL out-of-bounds memory access in Chrome prior to 146.0.7680.153 to prevent sandbox escape exploitation.
Implements memory protection safeguards such as ASLR, DEP, and stack canaries that directly counter out-of-bounds memory access vulnerabilities exploited via crafted HTML pages.
Enforces process isolation to strengthen browser sandboxing and limit the impact of potential escapes from WebGL memory corruption attacks.