Cyber Posture

CVE-2026-4676

High

Published: 24 March 2026

Published
24 March 2026
Modified
24 March 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0004 13.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4676 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 13.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mandates timely remediation of flaws like this use-after-free vulnerability through patching Chrome to version 146.0.7680.165 or later.

prevent

Implements memory protection mechanisms such as ASLR and DEP that mitigate exploitation of use-after-free vulnerabilities in browser components like Dawn.

prevent

Enforces process isolation via browser sandboxing to contain potential escapes from memory corruption exploits in WebGPU rendering processes.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Use-after-free vulnerability in Chromium WebGPU exploited via crafted HTML page with user interaction enables client-side exploitation for code execution (T1203) and sandbox escape for privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Use after free in Dawn in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Deeper analysisAI

CVE-2026-4676 is a use-after-free vulnerability (CWE-416) in Dawn, the WebGPU implementation within Chromium, affecting Google Chrome versions prior to 146.0.7680.165. Published on 2026-03-24, it carries a Chromium security severity rating of High and a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A remote attacker can exploit this flaw by luring a user to interact with a crafted HTML page, potentially achieving a sandbox escape. The attack requires user interaction but no privileges, with low complexity over the network, enabling high confidentiality, integrity, and availability impacts.

Google mitigated the issue via a stable channel update for desktop Chrome, as announced in the Chrome Releases blog (https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html). Additional details are available in the Chromium issue tracker (https://issues.chromium.org/issues/488613135). Security practitioners should ensure systems update to version 146.0.7680.165 or later.

Details

CWE(s)

Affected Products

google
chrome
≤ 146.0.7680.164

CVEs Like This One

CVE-2026-6304Same product: Apple Macos
CVE-2026-6309Same product: Apple Macos
CVE-2026-5289Same product: Apple Macos
CVE-2026-5874Same product: Apple Macos
CVE-2026-6297Same product: Apple Macos
CVE-2026-3924Same product: Apple Macos
CVE-2026-5860Same product: Apple Macos
CVE-2026-7349Same product: Apple Macos
CVE-2026-3923Same product: Apple Macos
CVE-2026-4456Same product: Apple Macos

References