CVE-2026-4460
Published: 20 March 2026
Summary
CVE-2026-4460 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 16.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-4460 is an out-of-bounds read vulnerability (CWE-125) in the Skia graphics library within Google Chrome prior to version 146.0.7680.153. The flaw enables a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. Chromium security severity is rated as High, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker can exploit this vulnerability by luring a user to visit a malicious website hosting the crafted HTML page, requiring user interaction but no privileges. Exploitation leads to an out-of-bounds memory read, with high potential impacts on confidentiality, integrity, and availability.
The Chrome Releases blog and Chromium issue tracker detail the patch in the stable channel update to version 146.0.7680.153, published on 2026-03-20. Mitigation involves updating affected Google Chrome installations to this version or later.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13477
Vulnerability details
Out of bounds read in Skia in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read in Chrome/Skia triggered by crafted HTML on malicious site directly enables drive-by compromise (T1189) and client-side exploitation for code execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely identification, reporting, and correction of flaws like the out-of-bounds read in Skia, directly aligning with the patch to Chrome 146.0.7680.153.
Implements memory protections such as ASLR and DEP to prevent information disclosure and exploitation from out-of-bounds reads in browser components like Skia.
Enables scanning for known vulnerabilities like CVE-2026-4460 in Chrome installations to identify and remediate affected versions before exploitation.