Platform
chrome
Component
chrome-fonts
Fixed in
146.0.7680.165
CVE-2026-4679 describes an Integer Overflow vulnerability discovered in Chrome Fonts. This flaw enables a remote attacker to trigger an out-of-bounds memory write by crafting a malicious HTML page, potentially leading to denial of service or, in a more severe scenario, arbitrary code execution. The vulnerability affects Google Chrome versions prior to 146.0.7680.165, and a fix has been released in version 146.0.7680.165.
The Integer Overflow vulnerability in Chrome Fonts allows an attacker to manipulate memory allocation within the font rendering engine. By crafting a specially designed HTML page, an attacker can trigger an overflow condition, leading to a write outside the intended memory boundaries. This can result in a crash of the Chrome browser, potentially leading to a denial-of-service. More critically, a successful exploit could allow the attacker to overwrite critical data structures, potentially enabling arbitrary code execution within the browser's process. The impact is significant, as it could allow an attacker to gain control of the user's system through a seemingly innocuous web page.
CVE-2026-4679 was publicly disclosed on 2026-03-24. There is currently no known public proof-of-concept (POC) code available. The vulnerability has been assessed as High severity by the Chromium security team. It is not currently listed on the CISA KEV catalog, but its high severity warrants monitoring for potential exploitation. The vulnerability's reliance on crafting a specific HTML page suggests exploitation would require a user to visit a malicious website.
Exploit Status
EPSS
0.11% (29% percentile)
The primary mitigation for CVE-2026-4679 is to immediately upgrade to Google Chrome version 146.0.7680.165 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing stricter content security policies (CSP) to restrict the execution of inline scripts and the loading of external resources from untrusted sources. While a direct WAF rule is unlikely to be effective against this type of memory corruption vulnerability, ensuring that Chrome is running with the least privilege possible can limit the potential damage if an exploit is successful. Regularly scan your systems for outdated Chrome installations.
Update Google Chrome to version 146.0.7680.165 or later. This will address the integer overflow vulnerability in font handling that allows out-of-bounds memory writes.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-4679 is an Integer Overflow vulnerability in Google Chrome Fonts that allows out-of-bounds memory writes via crafted HTML, potentially leading to crashes or code execution.
You are affected if you are using Google Chrome versions prior to 146.0.7680.165. Check your Chrome version and update if necessary.
Upgrade to Google Chrome version 146.0.7680.165 or later to mitigate the vulnerability. Ensure automatic updates are enabled.
There is currently no known active exploitation of CVE-2026-4679, but the high severity warrants monitoring.
Refer to the official Google Security Blog for details: https://security.googleblog.com/
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.