CVE-2026-4440
Published: 20 March 2026
Summary
CVE-2026-4440 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 7.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely remediation of the specific WebGL out-of-bounds read/write flaw in Chrome via patching to version 146.0.7680.153.
Implements memory protection mechanisms that directly counter out-of-bounds read and write operations exploited through crafted HTML pages in WebGL.
Enforces process isolation in the browser's sandboxed renderer processes to limit the scope of compromise from WebGL vulnerabilities.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB read/write in Chrome WebGL enables direct exploitation via crafted HTML page for drive-by browser compromise (T1189) and client application code execution (T1203).
NVD Description
Out of bounds read and write in WebGL in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Critical)
Deeper analysisAI
CVE-2026-4440 is an out-of-bounds read and write vulnerability (CWE-125, CWE-787) in the WebGL component of Google Chrome prior to version 146.0.7680.153. Published on 2026-03-20, it has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated Critical by Chromium security standards. The flaw allows a remote attacker to perform arbitrary read and write operations via a crafted HTML page.
A remote attacker without privileges can exploit this vulnerability over the network with low complexity by luring a user to interact with a malicious site, such as by visiting a crafted HTML page. Successful exploitation provides high-impact consequences across confidentiality, integrity, and availability, enabling potential full compromise of the affected browser instance.
Google's stable channel update for desktop Chrome, available at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html, patches this issue in version 146.0.7680.153. Additional details on the fix are documented in the Chromium issue tracker at https://issues.chromium.org/issues/485935305.
Details
- CWE(s)