High

Use-after-free in Google Chrome Base

IdentifiersCVE-2026-4441CWE-416· Use After Free

CVE-2026-4441 is a critical use-after-free vulnerability in the Base component of Google Chrome prior to version 146.0.7680.153. The flaw is described as a memory lifetime management error in which previously freed memory can be accessed again, creating a condition for heap corruption. According to the provided content, a remote attacker could trigger the issue by convincing a user to load a crafted HTML page. In Chrome’s multi-component architecture, such memory corruption flaws are commonly exploitable for renderer compromise and potentially further code execution depending on exploit reliability and available sandbox escape chains, but the provided content specifically confirms heap corruption potential and broader arbitrary code execution risk across the affected update set.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation could allow a remote attacker to trigger heap corruption in Chrome by means of malicious web content. As stated in the provided material, Chromium security rated the issue Critical, and the broader advisory notes that vulnerabilities in this release could result in arbitrary code execution, denial of service, or information disclosure. For this specific CVE, the confirmed direct impact is heap corruption reachable from a crafted HTML page; in practical terms, this class of bug may enable browser process compromise and potentially remote code execution in the context of the targeted Chrome process.

Mitigation

If you can’t patch tonight, do this now.

Until patching is completed, reduce exposure by limiting use of untrusted websites and isolating high-risk browsing activity. Enterprise defenders can temporarily restrict browser use to trusted destinations, enforce site isolation and sandboxing defaults, and monitor for crashes or anomalous child-process behavior associated with malicious web content. Because exploitation requires delivery of a crafted HTML page, web filtering, URL reputation controls, and user-risk reduction measures may lower exposure, but these are only temporary mitigations and do not replace upgrading to a fixed Chrome/Chromium version.

Remediation

Patch, then assume compromise.

Upgrade Google Chrome/Chromium to a fixed version. The provided content states that Google addressed this issue in Chrome 146.0.7680.153, with Windows and macOS also receiving 146.0.7680.154 in the same release train, and Linux receiving 146.0.7680.153. Any Chrome version prior to 146.0.7680.153 should be considered vulnerable based on the supplied description. Apply the vendor security update through normal browser update channels or enterprise package management as soon as possible.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GoogleChromeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

cyber security newsNews

Mar 21, 2026

Chrome Security Update Patches 26 Vulnerabilities that Enable Attackers to Execute Malicious Code Remotely

A critical use-after-free vulnerability in Chrome's Base component that could allow remote code execution when triggered by malicious web content.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-4441

NVD

nvd.nist.gov/vuln/detail/CVE-2026-4441

MITRE CWE · CWE-416

Use After Free

Vendor Advisory

chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html

Issue Tracking

issues.chromium.org/issues/489381399