CVE-2026-4673
Published: 24 March 2026
Summary
CVE-2026-4673 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 39.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-39 (Process Isolation).
Deeper analysis
CVE-2026-4673 is a heap buffer overflow vulnerability in the WebAudio component of Google Chrome versions prior to 146.0.7680.165. The flaw allows a remote attacker to perform an out-of-bounds memory write through a crafted HTML page. It is associated with CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write), and carries a Chromium security severity rating of High, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or interacting with a crafted HTML page, as it requires user interaction but no special privileges. Successful exploitation enables high-impact effects on confidentiality, integrity, and availability, potentially leading to arbitrary code execution or system compromise within the browser's sandboxed environment.
Google's stable channel update for desktop, documented at chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html, addresses the issue in Chrome 146.0.7680.165. Additional details are available in the Chromium issue tracker at issues.chromium.org/issues/485397284. Mitigation involves updating affected Chrome installations to version 146.0.7680.165 or later.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14676
Vulnerability details
Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in Chrome WebAudio enables arbitrary code execution via crafted HTML page, directly mapping to drive-by compromise (T1189) and exploitation for client execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely identification, reporting, and correction of flaws like the heap buffer overflow in Chrome's WebAudio component via patching to version 146.0.7680.165 or later.
Implements memory protection mechanisms such as heap hardening, address space randomization, and guard pages to mitigate out-of-bounds writes from crafted WebAudio inputs.
Enforces process isolation through browser sandboxing to contain exploitation of the WebAudio heap overflow within the renderer process, limiting potential system compromise.