CVE-2026-4680
Published: 24 March 2026
Summary
CVE-2026-4680 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 16.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely identification, reporting, testing, and installation of patches to remediate the use-after-free vulnerability in Chrome's FedCM component as provided in version 146.0.7680.165.
Implements memory protection techniques such as address space layout randomization and data execution prevention to mitigate use-after-free exploits like CVE-2026-4680.
Requires vulnerability scanning to identify systems running vulnerable Chrome versions prior to 146.0.7680.165 affected by the FedCM use-after-free.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is exploited via a crafted HTML page in Google Chrome, enabling drive-by compromise (T1189) and exploitation for client execution (T1203) through arbitrary code execution in the browser sandbox upon user visit.
NVD Description
Use after free in FedCM in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-4680 is a use-after-free vulnerability (CWE-416) in the FedCM component of Google Chrome prior to version 146.0.7680.165. Published on 2026-03-24, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High severity by the Chromium security team.
A remote attacker can exploit this issue via a crafted HTML page, leading to arbitrary code execution inside the browser's sandbox. Exploitation requires user interaction, such as visiting the malicious page, but no privileges or special access are needed.
Google's Chrome Releases blog announces a stable channel update for desktop that addresses this vulnerability (https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html). Additional details are available in the Chromium issue tracker (https://issues.chromium.org/issues/491869946). Security practitioners should ensure Chrome is updated to 146.0.7680.165 or later.
Details
- CWE(s)