Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
High

Out-of-bounds read/write in Chrome WebGL ANGLE Vulkan backend

IdentifiersCVE-2026-4440CWE-190

CVE-2026-4440 is a critical memory corruption vulnerability in Google Chrome's WebGL implementation, specifically in the ANGLE Vulkan backend, affecting Chrome versions prior to 146.0.7680.153. The issue is described as an out-of-bounds read and write reachable via a crafted HTML page. Supporting content indicates the root cause is a 32-bit integer overflow during texture buffer size calculation for texStorage3D() operations. A trigger example is a 4096×4096 RGBA8 texture array with 64 or more layers, where the computed size reaches 2^32 bytes and wraps to zero in a 32-bit accumulator. Subsequent operations in downstream paths, including copyImageDataToBuffer() in vk_helpers.cpp and a format-conversion path around TextureVk.cpp line 3176, can then read from or write past the allocated buffer. This makes the bug remotely reachable through malicious WebGL content rendered in the browser.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can give a remote attacker arbitrary read/write primitives in the vulnerable process context via malicious WebGL content. The provided material states this can be used to perform arbitrary read/write and that Chromium rated the issue Critical. In practical terms, this level of memory corruption can enable information disclosure, browser process compromise, denial of service, and potentially remote code execution as part of a broader exploit chain, depending on target platform, process isolation boundaries, and availability of additional exploitation steps.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by restricting or disabling access to untrusted WebGL content where operationally feasible, limiting browsing to trusted sites, and applying enterprise browser controls that reduce attack surface for GPU-accelerated web content. Monitor for suspicious WebGL activity consistent with the reported trigger pattern, such as texStorage3D() calls involving 4096×4096 RGBA8 textures with depth 64 or greater, and investigate anomalous browser crashes or GPU process instability. These are temporary risk-reduction measures only; patching is the primary mitigation.

Remediation

Patch, then assume compromise.

Upgrade Google Chrome/Chromium to a fixed release. The provided content states Chrome patched CVE-2026-4440 in version 146.0.7680.153 or later, with 146.0.7680.154 also referenced for Windows and macOS. Organizations should deploy the latest stable version available from Google or their downstream Chromium vendor and ensure all managed endpoints are updated promptly.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
GoogleChromeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.