CVE-2026-4444
Published: 20 March 2026
Summary
CVE-2026-4444 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 21.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-4444 is a stack buffer overflow vulnerability (CWE-121) in the WebRTC component of Google Chrome prior to version 146.0.7680.153. It enables a remote attacker to potentially exploit stack corruption by means of a crafted HTML page. The issue carries a Chromium security severity rating of High and a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker without privileges can exploit this vulnerability over the network with low complexity by tricking a user into interacting with—such as loading—a malicious HTML page, for example via a phishing link. Successful exploitation could grant high-impact confidentiality, integrity, and availability compromises, potentially allowing arbitrary code execution or system compromise on the affected browser instance.
Mitigation is available via the stable channel update for Chrome desktop, which patches the vulnerability in version 146.0.7680.153 and later, as announced in the Chrome Releases Google Blog. Further technical details on the issue and fix are documented in the Chromium bug tracker.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13455
Vulnerability details
Stack buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack buffer overflow in Chrome WebRTC enables RCE via crafted/malicious HTML page (phishing link or drive-by visit), directly mapping to drive-by compromise of client browser and exploitation for client-side code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates identification, reporting, and correction of flaws like the stack buffer overflow in Chrome's WebRTC component via timely patching to version 146.0.7680.153 or later.
Implements memory protections such as stack canaries, ASLR, and DEP to prevent exploitation of stack corruption from buffer overflows triggered by crafted HTML pages.
Requires scanning for vulnerabilities like CVE-2026-4444 in Chrome installations to identify and remediate unpatched versions before remote exploitation occurs.