CVE-2026-3537: Google Chrome Use-After-Free Vulnerability

CVE-2026-3537 Overview

CVE-2026-3537 is an object lifecycle vulnerability in the PowerVR component of Google Chrome on Android. This vulnerability exists in versions prior to 145.0.7632.159 and allows a remote attacker to potentially exploit heap corruption through a crafted HTML page. The Chromium security team has classified this vulnerability as Critical severity.

Critical Impact

Remote attackers can exploit heap corruption through malicious HTML pages, potentially leading to arbitrary code execution on affected Android devices running vulnerable Chrome versions.

Affected Products

• Google Chrome on Android prior to version 145.0.7632.159
• Apple macOS (as platform)
• Linux Kernel (as platform)
• Microsoft Windows (as platform)

Discovery Timeline

• 2026-03-04 - CVE-2026-3537 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-3537

Vulnerability Analysis

This vulnerability stems from improper object lifecycle management within the PowerVR graphics driver integration in Google Chrome. The flaw is categorized as CWE-787 (Out-of-Bounds Write), indicating that the vulnerability involves writing data past the boundaries of allocated memory buffers.

The attack requires user interaction—specifically, a victim must navigate to a malicious webpage. Once triggered, the heap corruption can be weaponized to achieve code execution within the browser's context. The vulnerability affects the confidentiality, integrity, and availability of the system, potentially allowing attackers to read sensitive data, modify system state, or crash the browser.

Root Cause

The root cause is an object lifecycle management error in the PowerVR component. When certain graphics operations are performed, the browser may continue to reference memory after the associated object has been freed or reallocated. This creates a condition where heap memory can be corrupted when the dangling reference is subsequently used, leading to an out-of-bounds write condition.

Attack Vector

The attack vector is network-based, requiring an attacker to host or inject a specially crafted HTML page. The exploitation scenario unfolds as follows:

1. The attacker creates a malicious webpage containing crafted HTML and JavaScript that triggers specific graphics operations
2. The victim navigates to the malicious page using an affected version of Google Chrome on Android
3. The crafted content triggers the object lifecycle flaw in the PowerVR component
4. Heap corruption occurs, which can be leveraged for arbitrary code execution

The vulnerability requires no special privileges and can be exploited by any remote attacker who can deliver malicious content to the victim's browser. However, user interaction (visiting the page) is required for successful exploitation.

Detection Methods for CVE-2026-3537

Indicators of Compromise

• Unexpected browser crashes or instability when visiting certain web pages
• Chrome crash reports indicating heap corruption in PowerVR or graphics-related components
• Anomalous memory allocation patterns in browser processes
• Suspicious network connections originating from browser processes after visiting unknown sites

Detection Strategies

• Monitor Chrome version across fleet to identify installations below 145.0.7632.159
• Implement browser crash telemetry analysis to detect heap corruption patterns
• Deploy endpoint detection rules for anomalous behavior following Chrome crashes
• Review web proxy logs for access to domains known to host exploit kits

Monitoring Recommendations

• Enable Chrome crash reporting and analyze for PowerVR-related stack traces
• Monitor for unusual child processes spawned by Chrome browser processes
• Implement network traffic analysis for post-exploitation command and control patterns
• Track Chrome update compliance across all managed Android devices

How to Mitigate CVE-2026-3537

Immediate Actions Required

• Update Google Chrome on Android to version 145.0.7632.159 or later immediately
• Enable automatic updates for Google Chrome across all managed devices
• Consider implementing web filtering to block access to untrusted domains until patching is complete
• Advise users to avoid clicking on links from untrusted sources

Patch Information

Google has released a security update addressing this vulnerability in Chrome version 145.0.7632.159. The patch resolves the object lifecycle issue in the PowerVR component. For complete details, refer to the Google Chrome Stable Channel Update and the Chromium Issue Tracker Entry.

Organizations should prioritize deployment of this update given the critical nature of the vulnerability and the potential for remote code execution.

Workarounds

• If immediate patching is not possible, consider temporarily restricting Chrome usage on Android devices for sensitive operations
• Implement strict web content filtering to reduce exposure to potentially malicious sites
• Enable Chrome's Site Isolation feature if not already active to limit the impact of potential exploitation
• Consider using an alternative browser on Android until the Chrome update can be applied

# Verify Chrome version on Android via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Force Chrome update check (requires user interaction on device)
# Navigate to: Settings > Apps > Chrome > App details in store > Update