Executive brief
Google Chrome is a widely used web browser. A security vulnerability in how the browser handles website styling (CSS) could allow a malicious website to run unauthorized code on a user's computer. While this code would be restricted by the browser's security sandbox, it still poses a risk to the integrity of the browsing session and could be used as part of a more complex attack.
Technical details
A use-after-free (UAF) vulnerability exists in the CSS engine of Google Chrome (CWE-416). The flaw is triggered when the browser incorrectly manages memory for CSS objects, allowing an attacker to reference memory after it has been freed. By enticing a user to visit a malicious HTML page, a remote, unauthenticated attacker can exploit this condition to achieve arbitrary code execution (ACE) within the context of the Chromium sandbox. This vulnerability was addressed in version 146.0.7680.178 for Windows and Mac, and 146.0.7680.177 for Linux.
Affected products
- Google Chrome prior to 146.0.7680.178
Timeline
- 2026-03-18: other: Reported by anonymous researcher
- 2026-03-31: patched: Stable channel update released
- 2026-04-01: disclosed: NVD publication date