Description
Out of bounds read in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
Published: 2026-03-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote memory disclosure via out-of-bounds read
Action: Patch immediately
AI Analysis

Impact

A flaw in the Blink rendering engine of Google Chrome releases prior to 146.0.7680.153 allows an attacker to read memory locations beyond the bounds of allocated buffers when a specially constructed HTML page is rendered. This out‑of‑bounds memory read could expose sensitive data stored in the browser process, corresponding to CWE‑125. The vulnerability is classified as high severity by the Chromium security team.

Affected Systems

Google Chrome browsers on Windows, macOS, and Linux are affected. The issue exists in all Chrome builds dated before 146.0.7680.153, regardless of the operating system.

Risk and Exploitability

The CVSS v3.1 score is 8.8, indicating a high impact if exploited. The EPSS score of less than 1% suggests that attacks using this flaw are currently infrequent, yet the vulnerability is not listed in the CISA KEV catalog. An attacker could exploit it by hosting a malicious web page that the victim opens, triggering the out‑of‑bounds read.

Generated by OpenCVE AI on March 20, 2026 at 20:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome to version 146.0.7680.153 or newer.
  • Enable automatic browser updates to receive future security patches.
  • If an update cannot be applied immediately, avoid browsing untrusted websites or temporarily disable the browser.

Generated by OpenCVE AI on March 20, 2026 at 20:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6171-1 chromium security update
History

Fri, 20 Mar 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Fri, 20 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Fri, 20 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
Title Chrome Out‑of‑Bounds Read in Blink (CVE‑2026‑4462) chromium-browser: Out of bounds read in Blink
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

threat_severity

Important

Fri, 20 Mar 2026 11:15:00 +0000

Type Values Removed Values Added
Title Chrome Out‑of‑Bounds Read in Blink (CVE‑2026‑4462)

Fri, 20 Mar 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 20 Mar 2026 02:15:00 +0000

Type Values Removed Values Added
Description Out of bounds read in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-125
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-03-21T04:01:26.991Z

Reserved: 2026-03-19T20:23:55.499Z

Link: CVE-2026-4462

cve-icon Vulnrichment

Updated: 2026-03-20T14:18:08.867Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-20T02:16:39.603

Modified: 2026-03-20T17:57:26.947

Link: CVE-2026-4462

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-18T00:00:00Z

Links: CVE-2026-4462 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-03-25T14:09:44Z

Weaknesses