CVE-2026-4462
Published: 20 March 2026
Summary
CVE-2026-4462 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 16.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-4462 is an out-of-bounds read vulnerability (CWE-125) in the Blink rendering engine within Google Chrome versions prior to 146.0.7680.153. It enables a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is classified as High severity by Chromium security.
A remote attacker can exploit this vulnerability over the network with low complexity and no privileges required, though it necessitates user interaction such as visiting a malicious site. Exploitation allows high-impact consequences, including unauthorized access to sensitive memory contents, potential integrity violations, and denial of service.
Mitigation is available via the Google Chrome stable channel update to version 146.0.7680.153 or later, as announced in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html. Additional details on the fix are provided in Chromium issue tracker entry 491080830 at https://issues.chromium.org/issues/491080830. Security practitioners should prioritize updating affected Chrome installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13479
Vulnerability details
Out of bounds read in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB read in Blink via crafted HTML page directly enables drive-by browser exploitation (T1189) and client-side code/memory abuse (T1203) with user visit as trigger.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely identification, reporting, and correction of software flaws like the out-of-bounds read in Chrome's Blink engine via patching to version 146.0.7680.153 or later.
Implements memory protection mechanisms such as address space layout randomization and stack canaries to directly mitigate out-of-bounds memory read vulnerabilities.
Enforces process isolation through sandboxing in browsers like Chrome to limit the impact of Blink renderer vulnerabilities exploited via crafted HTML.