CVE-2026-4679: Google Chrome RCE Vulnerability

CVE-2026-4679 Overview

CVE-2026-4679 is an integer overflow vulnerability in the Fonts component of Google Chrome prior to version 146.0.7680.165. The flaw allows a remote attacker to trigger an out-of-bounds memory write by serving a crafted HTML page to a victim. Chromium's security team rated the issue High severity. Successful exploitation requires user interaction, specifically navigation to attacker-controlled content. The vulnerability affects Chrome on Windows, macOS, and Linux platforms. It is tracked under [CWE-190] Integer Overflow or Wraparound and [CWE-472] External Control of Assumed-Immutable Web Parameter, which can lead to memory corruption and potential arbitrary code execution within the renderer process.

Critical Impact
Remote attackers can achieve out-of-bounds memory write by luring users to a malicious HTML page, potentially leading to code execution within the Chrome renderer process.

Affected Products

Google Chrome versions prior to 146.0.7680.165
Chrome on Microsoft Windows, Apple macOS, and Linux
Chromium-based browsers using the affected Fonts component

Discovery Timeline

2026-03-24 - CVE-2026-4679 published to NVD
2026-03-24 - Last updated in NVD database
2026-03-23 - Google releases Stable Channel update for desktop containing the fix

Technical Details for CVE-2026-4679

Vulnerability Analysis

The vulnerability resides in the Fonts subsystem of Chrome's rendering pipeline. An integer overflow occurs when processing font data parsed from a crafted HTML document. When arithmetic on font-related size or offset values wraps around, the resulting undersized allocation or miscalculated index permits a write outside the intended buffer boundary.

The out-of-bounds write occurs within the renderer process. Attackers leveraging this primitive can corrupt adjacent heap memory structures, potentially overwriting function pointers, virtual table entries, or sandbox-relevant state. Chained with a sandbox escape, the flaw could yield full arbitrary code execution on the host. Without a sandbox bypass, exploitation remains confined to the renderer but still enables credential theft, session compromise, and same-origin policy violations.

Root Cause

The root cause is unchecked arithmetic on integer values derived from attacker-controlled font data. The Fonts component computes buffer sizes or offsets without validating that the result fits within the target integer type. The overflow produces a value smaller than expected, causing downstream code to write past the allocated region.

Attack Vector

Exploitation is network-based and requires user interaction. The victim must visit a web page hosting the crafted font payload. No authentication is required, and the attack complexity is low. The crafted HTML page references or embeds a malformed font resource that triggers the overflow during parsing or shaping. Drive-by download scenarios, malvertising, and phishing links are realistic delivery channels.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. See the Chromium Issue Tracker Entry for additional technical context.

Detection Methods for CVE-2026-4679

Indicators of Compromise

Unexpected Chrome renderer process crashes correlated with browsing activity
Outbound connections from chrome.exe child processes to untrusted domains following font-heavy page loads
Anomalous child processes spawned by the Chrome renderer or GPU process
Browser telemetry showing repeated navigation to pages serving malformed font resources

Detection Strategies

Inventory Chrome installations and flag any version below 146.0.7680.165 as vulnerable
Monitor endpoint telemetry for renderer process crashes with access violation signatures involving font libraries
Correlate web proxy logs with crash events to identify domains delivering exploit content
Apply behavioral detections for post-exploitation activity such as unexpected process injection from browser processes

Monitoring Recommendations

Enable browser crash reporting and forward Windows Error Reporting, macOS crash logs, and Linux core dumps to a central SIEM
Track Chrome version compliance across managed endpoints using enterprise management tools
Alert on Chrome renderer processes spawning shells, scripting engines, or LOLBins
Review web filtering logs for traffic to newly registered or low-reputation domains preceding crash events

How to Mitigate CVE-2026-4679

Immediate Actions Required

Update Google Chrome to version 146.0.7680.165 or later on all Windows, macOS, and Linux endpoints
Force a browser restart after update deployment to ensure the patched binary is loaded
Audit Chromium-based browsers and embedded WebViews for derivative builds that require updates
Verify enterprise policies permit automatic Chrome updates and remove blockers where present

Patch Information

Google addressed the vulnerability in the Stable Channel update released on March 23, 2026, shipping Chrome 146.0.7680.165 for desktop. Refer to the Google Chrome Stable Update advisory for full release notes and rollout guidance.

Workarounds

Restrict browsing to trusted sites via web filtering until patching is complete
Deploy Chrome enterprise policies that disable web fonts on high-risk endpoints where business workflows allow
Use site isolation and ensure the Chrome sandbox is enabled to limit renderer compromise impact
Educate users to avoid clicking untrusted links until updates are confirmed in place

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Windows PowerShell - check installed Chrome version
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS - check installed Chrome version
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version