Integer overflow in Google Chrome Fonts

Successful exploitation can result in an out-of-bounds memory write, creating a memory corruption condition in Chrome. Based on the provided CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the vulnerability can have high impact on confidentiality, integrity, and availability. In practical terms, exploitation may enable arbitrary code execution in the browser context, browser compromise, application crash/denial of service, and potentially further compromise depending on runtime conditions and available sandbox escape chains.

Apply the vendor patch as the primary mitigation. Until patching is complete, reduce exposure by limiting access to untrusted or attacker-controlled websites, enforcing browser isolation or sandboxing controls where available, and using enterprise web filtering to block malicious content delivery. Because exploitation requires a crafted HTML page and user interaction, user exposure can also be reduced through controlled browsing policies and prompt browser restarts after updates are installed.

Upgrade Google Chrome to version 146.0.7680.165 or later. The provided content states that Google released fixes in Chrome 146.0.7680.164/165 for Windows and Mac and 146.0.7680.164 for Linux as part of the March 2026 Stable channel security update; however, the vulnerability description specifically states affected versions are prior to 146.0.7680.165. Organizations should deploy the latest vendor-provided Chrome update across endpoints and ensure browsers are restarted so the patched version is active.