CVE-2026-4454: High Use after free in Network

Q: What is the severity of CVE-2026-4454?

The severity of CVE-2026-4454 is classified as High.

Q: How do I fix CVE-2026-4454?

To fix CVE-2026-4454, update Google Chrome to version 146.0.7680.153 or later.

Q: What type of vulnerability is CVE-2026-4454?

CVE-2026-4454 is a use after free vulnerability impacting the Network component in Google Chrome.

Q: Can CVE-2026-4454 be exploited remotely?

Yes, CVE-2026-4454 allows a remote attacker to exploit heap corruption through a crafted HTML page.

Q: Which versions of Google Chrome are affected by CVE-2026-4454?

Google Chrome versions prior to 146.0.7680.153 are affected by CVE-2026-4454.

Published Mar 1, 2026

Updated

Chromium: CVE-2026-4454 Use after free in Network

Other sources

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

— Microsoft

Use after free in Network in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

— NVD

Credit

heapracer@@heapracer

Affected Software

10 affected componentsFixes available

Google Chrome<146.0.7680.153

All of the following

Google Chrome<146.0.7680.153

Any of the following

Apple macOS

Linux Linux kernel

Microsoft Windows

Microsoft Edge (Chromium-based)

Patch available

Microsoft Edge<146.0.3856.72

alpine/qt6-qtwebengine<6.10.1-r12

6.10.1-r12

alpine/qt6-qtwebengine<6.10.2-r11

6.10.2-r11

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/qt6-qtwebengine to a version that resolves this vulnerability.
Fixed in 6.10.1-r12
Upgrade
Upgrade alpine/qt6-qtwebengine to a version that resolves this vulnerability.
Fixed in 6.10.2-r11
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 146.0.7680.153

Event History

Mar 20, 2026

CVE Published

via MITRE·01:34 AM

Data Sourced

via MITRE·01:34 AM

DescriptionWeakness

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Mar 23, 2026

Data Sourced

via Microsoft·07:45 AM

DescriptionSeverityWeaknessAffected Software

May 11, 2026

Data Sourced

12:00 AM

SeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2026-4454?

The severity of CVE-2026-4454 is classified as High.

How do I fix CVE-2026-4454?

To fix CVE-2026-4454, update Google Chrome to version 146.0.7680.153 or later.

What type of vulnerability is CVE-2026-4454?

CVE-2026-4454 is a use after free vulnerability impacting the Network component in Google Chrome.

Can CVE-2026-4454 be exploited remotely?

Yes, CVE-2026-4454 allows a remote attacker to exploit heap corruption through a crafted HTML page.

Which versions of Google Chrome are affected by CVE-2026-4454?

Google Chrome versions prior to 146.0.7680.153 are affected by CVE-2026-4454.

CVE-2026-4454: High Use after free in Network

Other sources

Credit

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-4454?

How do I fix CVE-2026-4454?

What type of vulnerability is CVE-2026-4454?

Can CVE-2026-4454 be exploited remotely?

Which versions of Google Chrome are affected by CVE-2026-4454?

Company

Resources

Contact