CVE-2026-4464
Published: 20 March 2026
Summary
CVE-2026-4464 is a high-severity External Control of Assumed-Immutable Web Parameter (CWE-472) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 16.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-4464 is an integer overflow vulnerability in the ANGLE graphics component of Google Chrome prior to version 146.0.7680.153. The flaw enables potential heap corruption when processing a crafted HTML page, as reported on March 20, 2026. It maps to CWE-190 (Integer Overflow or Wraparound) and CWE-472 (External Control of Critical State Data), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Chromium security severity is rated as Medium.
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website, requiring no privileges or special access. The low attack complexity and network vector make it accessible to attackers worldwide. Successful exploitation could grant high-impact confidentiality, integrity, and availability violations, potentially leading to heap corruption and arbitrary code execution within the browser's renderer process.
Google's stable channel update addresses the issue in Chrome 146.0.7680.153 and later versions, as announced in the Chrome Releases blog at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html. Further technical details are available in the Chromium issue tracker at https://issues.chromium.org/issues/487208468. Security practitioners should prioritize updating affected browsers and advise users to enable automatic updates.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13481
Vulnerability details
Integer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer overflow in Chrome renderer (ANGLE) triggered by crafted HTML enables RCE via malicious website visit, directly mapping to drive-by compromise and client application exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation directly addresses the integer overflow in ANGLE by applying the Chrome 146.0.7680.153 patch to eliminate heap corruption.
Memory protection controls like ASLR and DEP prevent unauthorized code execution from heap corruption triggered by the integer overflow.
Process isolation confines exploitation of the renderer process vulnerability to a sandboxed domain, limiting potential damage.