CVE-2026-3538: Google Chrome RCE Vulnerability

CVE-2026-3538 Overview

CVE-2026-3538 is an integer overflow vulnerability in the Skia graphics library used by Google Chrome versions prior to 145.0.7632.159. A remote attacker can exploit the flaw to trigger out-of-bounds memory access by serving a crafted HTML page. Chromium classifies the underlying security severity as Critical, while NVD assigns a CVSS 3.1 base score of 8.8 under the HIGH severity rating. The vulnerability affects Chrome on Windows, macOS, and Linux. Successful exploitation requires user interaction such as visiting a malicious website. The defect is tracked under [CWE-191] (Integer Underflow) and [CWE-472] (External Control of Assumed-Immutable Web Parameter).

Critical Impact
Remote attackers can trigger out-of-bounds memory access in the Skia rendering engine through a crafted HTML page, potentially leading to arbitrary code execution inside the Chrome renderer process.

Affected Products

Google Chrome prior to 145.0.7632.159
Chrome desktop builds on Microsoft Windows
Chrome desktop builds on Apple macOS and Linux

Discovery Timeline

2026-03-04 - CVE-2026-3538 published to NVD following the Chrome Stable channel update
2026-03-11 - Last updated in the NVD database

Technical Details for CVE-2026-3538

Vulnerability Analysis

The flaw resides in Skia, the 2D graphics library that Chrome uses to render shapes, paths, text, and images. An integer overflow occurs during size or offset computations inside Skia's rendering pipeline. When the overflowed value is used to index a buffer or compute an allocation length, Skia reads or writes memory outside the intended bounds.

A remote attacker delivers attacker-controlled drawing primitives, canvas operations, or image data through a crafted HTML page. Once the renderer parses the content, the overflow corrupts internal state and yields out-of-bounds memory access. This typically results in renderer-process memory corruption, which attackers can chain with sandbox escapes to achieve full code execution.

The high impact ratings across confidentiality, integrity, and availability reflect the consequences of memory corruption inside the renderer.

Root Cause

The root cause is an arithmetic operation in Skia that does not validate operand ranges before computing a size, offset, or count. The resulting truncated or wrapped value bypasses subsequent bounds checks, allowing the engine to operate on memory regions outside the allocated buffer. The issue is categorized as [CWE-191] Integer Underflow related to assumed-immutable inputs ([CWE-472]).

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a malicious page that issues specifically crafted Skia drawing operations, for example through Canvas2D, WebGL paths, or image decoding. When the victim loads the page in a vulnerable Chrome build, the renderer processes the crafted content and triggers the overflow. No authentication is required, and the attack does not need elevated privileges on the target system.

No public proof-of-concept exploit is listed in Exploit-DB, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.101% as of 2026-05-14.

Detection Methods for CVE-2026-3538

Indicators of Compromise

Chrome renderer processes crashing with access-violation or segmentation-fault signatures after visiting an external site
Browser telemetry showing repeated chrome.exe or Google Chrome Helper (Renderer) crashes tied to Skia stack frames
Outbound connections from end-user hosts to newly registered domains immediately preceding renderer crashes
Chrome version strings below 145.0.7632.159 reported by managed endpoints

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build earlier than 145.0.7632.159
Monitor crash dump telemetry for renderer faults referencing Skia modules such as libskia or skia.dll
Correlate web proxy logs with crash events to identify the URL that triggered the renderer fault
Apply YARA or content rules to capture HTML containing anomalous canvas or path operations served to internal users

Monitoring Recommendations

Forward Chrome enterprise event logs and crash reports to a centralized SIEM or data lake for correlation
Track patch compliance using Chrome's BrowserVersion policy reporting or endpoint management tooling
Alert on unmanaged Chrome installations that fall behind the Stable channel for more than seven days
Review egress traffic from hosts that report renderer crashes to identify potential second-stage payload delivery

How to Mitigate CVE-2026-3538

Immediate Actions Required

Update Google Chrome to version 145.0.7632.159 or later on Windows, macOS, and Linux endpoints
Force-restart Chrome after deployment so the patched binaries are loaded into all renderer processes
Audit Chromium-based browsers and embedded webviews that ship the same Skia code and apply vendor updates as they are released
Restrict end-user browsing to trusted destinations for hosts that cannot be patched immediately

Patch Information

Google addressed the vulnerability in the Chrome Stable channel update documented in the Google Chrome Update Blog. The fix landed in Chrome 145.0.7632.159. Additional technical context is tracked in the Chromium Issue Tracker Entry.

Workarounds

Disable hardware acceleration to reduce attack surface against GPU-backed Skia paths until patches are deployed
Use enterprise policy to block navigation to untrusted sites that have not been categorized by the web filter
Deploy site isolation and ensure the Chrome sandbox is enabled to contain renderer-process compromise
Apply browser isolation or remote browsing for high-risk user populations on unpatched builds

bash

# Enforce minimum Chrome version via enterprise policy (Windows example)
# Save as a registry import or deploy through Group Policy
reg add "HKLM\Software\Policies\Google\Chrome" /v "BrowserSwitcherEnabled" /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v "RelaunchNotification" /t REG_DWORD /d 2 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v "RelaunchNotificationPeriod" /t REG_DWORD /d 86400000 /f