Use-after-free in Blink in Google Chrome

Successful exploitation may allow a remote, unauthenticated attacker to corrupt heap memory in the browser process by convincing a user to visit a maliciously crafted webpage. In the Chrome threat model, Blink memory corruption vulnerabilities can potentially result in browser process compromise, including arbitrary code execution, denial of service through renderer crashes, or possibly information disclosure, depending on exploit reliability and the surrounding sandbox and platform defenses. The provided content specifically states that the vulnerability could potentially be exploited via heap corruption.

If immediate patching is not possible, reduce exposure by limiting use of untrusted websites and isolating browser activity that renders attacker-controlled HTML. Enterprise defenders can temporarily restrict access to high-risk browsing destinations, enforce site isolation and sandboxing features where available, and run Chrome with the latest security hardening enabled. These are only temporary risk-reduction measures; the primary mitigation is to update to a fixed version.

Upgrade Google Chrome or Chromium-based packages to a fixed version. The provided content states that Google fixed this issue in Chrome 146.0.7680.153 and later, with Windows and macOS also receiving 146.0.7680.154 builds in the same release train. Systems running versions prior to 146.0.7680.153 should be updated immediately. For downstream Chromium packages, apply the vendor-supplied security updates that incorporate the upstream fix set for CVE-2026-4449.