Cyber Posture

CVE-2026-4458

High

Published: 20 March 2026

Published
20 March 2026
Modified
20 March 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0001 1.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4458 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Extensions (T1176.001); ranked at the 1.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Browser Extensions (T1176.001) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mandates timely flaw remediation through patching, addressing the specific use-after-free vulnerability fixed in Chrome version 146.0.7680.153.

prevent

Enforces policies to restrict or monitor user-installed software, preventing the installation of malicious Chrome extensions required to trigger the vulnerability.

prevent

Implements memory protection mechanisms that mitigate heap corruption exploits stemming from the use-after-free vulnerability in Chrome extensions.

MITRE ATT&CK Enterprise TechniquesAI

T1176.001 Browser Extensions Persistence
Adversaries may abuse internet browser extensions to establish persistent access to victim systems.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

UAF in Chrome Extensions component enables code execution when user installs a crafted malicious extension (T1176.001), constituting client-side exploitation (T1203) after user execution of the extension file (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Use after free in Extensions in Google Chrome prior to 146.0.7680.153 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

Deeper analysisAI

CVE-2026-4458 is a use-after-free vulnerability (CWE-416) in the Extensions component of Google Chrome prior to version 146.0.7680.153. Published on 2026-03-20, it allows heap corruption via a crafted Chrome Extension. Chromium security severity is rated High, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

The vulnerability can be exploited by an attacker who convinces a user to install a malicious extension. With network access, low attack complexity, and no required privileges beyond user interaction to install the extension, a successful exploit could result in high impacts to confidentiality, integrity, and availability, potentially enabling heap corruption and related code execution.

Mitigation is detailed in the Chrome Releases stable channel update blog post and the associated Chromium issue tracker entry. Security practitioners should advise users to update Google Chrome to version 146.0.7680.153 or later to patch the vulnerability.

Details

CWE(s)

Affected Products

google
chrome
≤ 146.0.7680.153

CVEs Like This One

CVE-2026-5287Same product: Apple Macos
CVE-2026-5904Same product: Apple Macos
CVE-2025-8576Same product: Apple Macos
CVE-2026-5860Same product: Apple Macos
CVE-2026-7349Same product: Apple Macos
CVE-2026-3923Same product: Apple Macos
CVE-2025-11756Same product: Apple Macos
CVE-2026-3921Same product: Apple Macos
CVE-2025-8578Same product: Apple Macos
CVE-2026-7338Same product: Apple Macos

References