CVE-2026-4676

—

CVSS 3.1

8.8 high

EPSS

<1%p29

Published

Mar 24, 2026 (Mar 24, 2026)

Modified

Jun 17, 2026

Description

Use after free in Dawn in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Vendors: google
Products: chrome
Weakness: CWE-416
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news1 stories

Google fixes Chrome zero-day with in-the-wild exploit (CVE-2026-5281)

Help Net SecurityApr 1, 00:00 UTC · Apr 1, 2026Exploit / PoC in the wildCVE-2026-5281 CVE-2026-4675 CVE-2026-4676+1 CVEs