CVE-2026-4676
Published: 24 March 2026
Summary
CVE-2026-4676 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 13.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely remediation of flaws like this use-after-free vulnerability through patching Chrome to version 146.0.7680.165 or later.
Implements memory protection mechanisms such as ASLR and DEP that mitigate exploitation of use-after-free vulnerabilities in browser components like Dawn.
Enforces process isolation via browser sandboxing to contain potential escapes from memory corruption exploits in WebGPU rendering processes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free vulnerability in Chromium WebGPU exploited via crafted HTML page with user interaction enables client-side exploitation for code execution (T1203) and sandbox escape for privilege escalation (T1068).
NVD Description
Use after free in Dawn in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-4676 is a use-after-free vulnerability (CWE-416) in Dawn, the WebGPU implementation within Chromium, affecting Google Chrome versions prior to 146.0.7680.165. Published on 2026-03-24, it carries a Chromium security severity rating of High and a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker can exploit this flaw by luring a user to interact with a crafted HTML page, potentially achieving a sandbox escape. The attack requires user interaction but no privileges, with low complexity over the network, enabling high confidentiality, integrity, and availability impacts.
Google mitigated the issue via a stable channel update for desktop Chrome, as announced in the Chrome Releases blog (https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html). Additional details are available in the Chromium issue tracker (https://issues.chromium.org/issues/488613135). Security practitioners should ensure systems update to version 146.0.7680.165 or later.
Details
- CWE(s)