CVE-2026-4456
Published: 20 March 2026
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2026-4456 is a use-after-free vulnerability (CWE-416) in the Digital Credentials API within Google Chrome prior to version 146.0.7680.153. This flaw, published on 2026-03-20, has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High severity by Chromium security standards.
The vulnerability enables a remote attacker who has already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Exploitation requires user interaction, such as visiting a malicious site, and assumes prior renderer compromise, leading to high impacts on confidentiality, integrity, and availability.
Mitigation involves updating to Google Chrome 146.0.7680.153 or later, as detailed in the Chrome Releases stable channel update blog at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html and Chromium issue tracker at https://issues.chromium.org/issues/488617440.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Use-after-free vulnerability enables sandbox escape after renderer compromise, directly facilitating exploitation for privilege escalation.