CVE-2026-3538: Google Chrome RCE Vulnerability

CVE-2026-3538 Overview

An integer overflow vulnerability exists in the Skia graphics library used by Google Chrome prior to version 145.0.7632.159. This critical security flaw allows remote attackers to potentially perform out-of-bounds memory access through a specially crafted HTML page. The vulnerability affects Skia's handling of integer arithmetic operations, which can lead to memory corruption when processing malicious content.

Critical Impact

A remote attacker can exploit this integer overflow vulnerability to execute arbitrary code or cause memory corruption by convincing a user to visit a malicious webpage, potentially leading to full system compromise.

Affected Products

• Google Chrome versions prior to 145.0.7632.159
• Chromium-based browsers on Microsoft Windows
• Chromium-based browsers on Apple macOS
• Chromium-based browsers on Linux

Discovery Timeline

• 2026-03-04 - CVE-2026-3538 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-3538

Vulnerability Analysis

This vulnerability is classified as an Integer Overflow (CWE-191) combined with External Externally Controlled Input (CWE-472) in the Skia graphics engine. Skia is a 2D graphics library that serves as the core rendering engine for Google Chrome and other Chromium-based browsers, handling all graphical content including HTML canvas elements, SVG rendering, and general page layout.

The integer overflow occurs during arithmetic operations that process graphical data, where insufficiently validated input values can wrap around and produce unexpectedly small buffer allocations. When the application subsequently writes data assuming the original (larger) size, it results in out-of-bounds memory access. This can corrupt adjacent memory structures, potentially allowing an attacker to hijack program execution flow.

The vulnerability requires user interaction—specifically, the victim must navigate to a webpage controlled by the attacker. However, this is a relatively low barrier given common attack vectors such as phishing emails, malicious advertisements, or compromised legitimate websites.

Root Cause

The root cause stems from insufficient validation of integer values used in memory allocation calculations within the Skia graphics library. When processing certain graphical elements, the library performs arithmetic operations on attacker-controlled input without properly checking for integer overflow conditions. This results in the allocation of undersized buffers that are subsequently accessed beyond their boundaries.

The specific flaw relates to how Skia handles dimensional calculations for graphical objects, where large input values can cause the result of multiplication operations to wrap around, producing a smaller-than-expected value used for buffer sizing.

Attack Vector

The attack is network-based and can be executed remotely. An attacker crafts a malicious HTML page containing specially designed graphical elements that trigger the integer overflow when rendered by the Skia engine. The attack chain proceeds as follows:

1. Attacker creates a webpage with malicious graphical content designed to trigger the integer overflow
2. Victim is lured to visit the attacker-controlled page through social engineering, malvertising, or other means
3. Chrome's Skia engine processes the malicious content and performs arithmetic operations that overflow
4. The overflow results in undersized buffer allocation followed by out-of-bounds memory access
5. Depending on heap layout and exploitation techniques, this can lead to arbitrary code execution

No proof-of-concept exploits are currently publicly available, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-3538

Indicators of Compromise

• Unexpected Chrome crashes or memory corruption errors when visiting certain websites
• Chrome sandbox escape attempts detected by endpoint security solutions
• Anomalous memory allocation patterns in browser processes
• Unusual child process spawning from Chrome renderer processes

Detection Strategies

• Monitor for Chrome versions below 145.0.7632.159 across the enterprise environment
• Implement browser telemetry collection to identify crash patterns associated with Skia rendering
• Deploy endpoint detection rules for heap corruption and out-of-bounds memory access in browser processes
• Enable Chrome's built-in crash reporting and analyze for patterns matching this vulnerability

Monitoring Recommendations

• Configure SentinelOne to alert on suspicious memory operations within Chrome processes
• Monitor network traffic for connections to known malicious domains serving exploit content
• Track Chrome version deployment status across endpoints to ensure patching compliance
• Review browser crash logs for evidence of attempted exploitation

How to Mitigate CVE-2026-3538

Immediate Actions Required

• Update Google Chrome to version 145.0.7632.159 or later immediately
• Enable automatic Chrome updates across all enterprise endpoints
• Verify update deployment through endpoint management solutions
• Consider temporary browsing restrictions for critical systems until patching is complete

Patch Information

Google has released Chrome version 145.0.7632.159 which addresses this vulnerability. The fix includes proper integer overflow checks in Skia's arithmetic operations to prevent the allocation of undersized buffers. Organizations should prioritize this update given the critical severity rating assigned by the Chromium security team.

For detailed patch information, refer to the Google Chrome Stable Channel Update announcement. Additional technical details may be available in the Chromium Issue Tracker.

Workarounds

• Restrict access to untrusted websites through web filtering until Chrome is updated
• Consider using browser isolation technologies for high-risk browsing activities
• Disable JavaScript on untrusted sites to reduce attack surface (may impact functionality)
• Implement network-level blocking of known malicious domains delivering exploit content
• Use SentinelOne's browser protection features to detect and block exploitation attempts