CVE-2026-4459
Published: 20 March 2026
Summary
CVE-2026-4459 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 19.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-4459 is an out-of-bounds read and write vulnerability (CWE-125, CWE-787) in the WebAudio component of Google Chrome prior to version 146.0.7680.153. Published on 2026-03-20, it enables potential heap corruption via a crafted HTML page and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), rated as High severity by Chromium.
A remote attacker can exploit this vulnerability over the network with low attack complexity and no privileges required, though it demands user interaction such as loading a malicious HTML page. Successful exploitation could grant high impacts on confidentiality, integrity, and availability, allowing heap corruption that may lead to arbitrary code execution or system compromise.
Google's Chrome Releases blog details a stable channel update for desktop addressing this issue, with additional technical information available in the Chromium issue tracker at issues.chromium.org/issues/490246422.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13476
Vulnerability details
Out of bounds read and write in WebAudio in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read/write in Chrome WebAudio via crafted HTML page directly enables drive-by compromise (T1189) and client-side exploitation for code execution (T1203), leading to RCE/system compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the specific out-of-bounds read/write flaw in Chrome's WebAudio component via patching to version 146.0.7680.153 or later.
Implements memory protection mechanisms such as ASLR and DEP to directly counter heap corruption from the WebAudio vulnerability.
Enforces process isolation through browser sandboxing to contain exploitation of the WebAudio heap corruption within renderer processes.