CVE-2026-4451
Published: 20 March 2026
Summary
CVE-2026-4451 is a high-severity Improper Input Validation (CWE-20) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 16.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4451 involves insufficient validation of untrusted input in the Navigation component of Google Chrome prior to version 146.0.7680.153. This vulnerability, mapped to CWE-20, allows a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Published on 2026-03-20, it has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High severity by Chromium security.
Exploitation requires a remote attacker to first compromise the Chrome renderer process, after which they can leverage a crafted HTML page to escape the sandbox. The attack is network-accessible with low complexity and no privileges needed, but user interaction is required. Successful exploitation enables high-impact confidentiality, integrity, and availability violations within an unchanged scope.
Mitigation is provided by updating to Google Chrome 146.0.7680.153 or later, as announced in the stable channel update at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html. Additional details are documented in the Chromium issue tracker at https://issues.chromium.org/issues/487768779.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13468
Vulnerability details
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 146.0.7680.153 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables exploitation of a client application (Chrome renderer) via crafted HTML for sandbox escape, facilitating client execution (T1203), privilege escalation (T1068), and defense evasion (T1211).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw Remediation requires timely patching of the specific input validation vulnerability in Chrome's Navigation component, directly preventing sandbox escape exploitation.
Information Input Validation enforces checks on untrusted inputs, directly countering the insufficient validation flaw (CWE-20) in the Navigation component.
Process Isolation maintains robust separation between the compromised renderer process and other system processes, mitigating sandbox escape attempts.