CVE-2026-4450: Google Chrome V8 RCE Vulnerability

CVE-2026-4450 Overview

CVE-2026-4450 is an out-of-bounds write vulnerability [CWE-787] in the V8 JavaScript engine used by Google Chrome. The flaw affects all Chrome versions prior to 146.0.7680.153 across Windows, macOS, and Linux. A remote attacker can trigger heap corruption by serving a crafted HTML page to a victim who visits the malicious site. Successful exploitation can lead to arbitrary code execution within the renderer process. Google rates the underlying Chromium security severity as High.

Critical Impact
Remote attackers can corrupt heap memory in the V8 engine through crafted web content, enabling potential arbitrary code execution in the browser renderer process.

Affected Products

Google Chrome versions prior to 146.0.7680.153
Chrome on Microsoft Windows, Apple macOS, and Linux platforms
Chromium-based browsers sharing the same V8 engine build

Discovery Timeline

2026-03-20 - CVE-2026-4450 published to NVD
2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-4450

Vulnerability Analysis

The vulnerability resides in V8, Chrome's open-source JavaScript and WebAssembly engine. An out-of-bounds write occurs when code writes data past the boundary of an allocated buffer on the heap. In V8, such conditions commonly arise from incorrect bounds checks during JIT compilation, type confusion in optimized code paths, or improper handling of typed arrays. Attackers leverage these primitives to corrupt adjacent heap objects, including object headers, function pointers, or JIT-generated code pages.

Root Cause

The root cause is improper memory boundary enforcement within V8 when processing attacker-controlled JavaScript. The defect is classified under [CWE-787], Out-of-bounds Write. Heap metadata or neighboring object fields can be overwritten with attacker-influenced values, breaking V8's internal invariants and enabling controlled corruption.

Attack Vector

Exploitation requires user interaction. A victim must visit a webpage hosting the crafted HTML and JavaScript payload. The attack vector is network-based and requires no privileges or authentication. Once the renderer is compromised, attackers typically chain the bug with a sandbox escape to achieve full code execution on the host. Detailed reproduction information is restricted in the Chromium Issue Report pending broad patch adoption.

No public proof-of-concept code has been released. Refer to the Google Chrome Release Update for vendor details.

Detection Methods for CVE-2026-4450

Indicators of Compromise

Chrome renderer processes crashing with heap corruption signatures shortly after visiting unfamiliar URLs
Unexpected child processes spawned by chrome.exe or the renderer helper on macOS and Linux
Outbound connections from browser processes to newly registered or low-reputation domains
Browser telemetry logs showing V8 runtime errors or sandbox policy violations

Detection Strategies

Inventory Chrome installations and flag any endpoint running a version below 146.0.7680.153
Monitor process lineage for anomalous child processes descending from browser renderers
Inspect web proxy logs for users visiting uncategorized domains immediately preceding browser crashes
Correlate endpoint crash dumps tagged with V8 stack frames against threat intelligence feeds

Monitoring Recommendations

Forward Chrome crash reports and EDR telemetry to a centralized analytics platform for correlation
Alert on renderer processes writing to unexpected file paths or loading unsigned modules
Track browser version drift across the fleet and prioritize remediation of outdated installs

How to Mitigate CVE-2026-4450

Immediate Actions Required

Update Google Chrome to version 146.0.7680.153 or later on all Windows, macOS, and Linux endpoints
Restart browser sessions after patch deployment to ensure the new V8 binary is loaded
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply equivalent vendor updates
Block known malicious domains at the proxy or DNS layer to reduce drive-by exposure

Patch Information

Google addressed the issue in the Stable channel update released March 18, 2026. The fixed version is Chrome 146.0.7680.153. Patch details are available in the Google Chrome Release Update. Enterprise administrators should validate auto-update enforcement through group policy or MDM tooling.

Workarounds

Enforce site isolation and disable JavaScript on untrusted origins where feasible
Restrict browsing to allowlisted domains for high-value user populations until patching completes
Deploy browser policies that prevent users from disabling automatic updates

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Windows registry check for enterprise-managed Chrome version
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# macOS version verification
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version