Integer Overflow in Google Chrome Fonts

Successful exploitation can cause out-of-bounds memory corruption in the browser process. Given the reported high severity and CVSS characteristics, impact may include compromise of confidentiality, integrity, and availability within the affected browser context, including potential arbitrary code execution, browser process compromise, or denial of service. In broader attack chains, such memory corruption may also contribute to sandbox bypass or host compromise when combined with additional vulnerabilities.

Apply the vendor update as the primary mitigation. Until patching is complete, reduce exposure by limiting use of untrusted websites and web content, enforcing rapid browser restart after update deployment, and using layered browser hardening controls available in enterprise environments. Because exploitation requires rendering attacker-controlled HTML, restricting access to untrusted content can reduce risk, but it is not a substitute for patching.

Update Google Chrome to a fixed version. The available fixed releases include Chrome 146.0.7680.165 or later for affected platforms, with stable-channel updates released as 146.0.7680.164/165 for Windows and Mac and 146.0.7680.164 for Linux as part of the March 2026 security rollout. Enterprise administrators should deploy the vendor-provided browser updates through standard patch management processes and ensure browsers are restarted so the fix takes effect.