CVE-2026-3539: Google Chrome Use-After-Free Vulnerability

CVE-2026-3539 Overview

CVE-2026-3539 is an object lifecycle vulnerability in the DevTools component of Google Chrome prior to version 145.0.7632.159. The flaw allows an attacker who convinces a user to install a malicious Chrome extension to trigger heap corruption through a crafted extension payload. Successful exploitation can lead to arbitrary code execution within the browser context. The issue is tracked under [CWE-1091] (Use of Object without Invoking Destructor Method) and impacts Chrome installations on Windows, macOS, and Linux. Google has rated the Chromium security severity as High and addressed the issue in the stable channel update released in March 2026.

Critical Impact
Heap corruption through a malicious extension can enable arbitrary code execution in the browser process, compromising user data and system integrity.

Affected Products

Google Chrome versions prior to 145.0.7632.159
Chrome installations on Microsoft Windows, Apple macOS, and Linux
Chromium-based browsers sharing the affected DevTools component

Discovery Timeline

2026-03-04 - CVE-2026-3539 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-3539

Vulnerability Analysis

The vulnerability resides in the Chrome DevTools subsystem, which exposes debugging and inspection interfaces to extensions and developers. An object lifecycle defect allows a crafted Chrome Extension to manipulate the allocation and destruction sequence of internal DevTools objects. This manipulation produces heap corruption that an attacker can shape to achieve code execution within the browser process.

Exploitation requires user interaction. A victim must be persuaded to install a malicious extension from outside the standard review pipeline or from a compromised distribution channel. Once installed, the extension exercises the affected DevTools APIs to trigger the corruption without further user action.

The EPSS data indicates a current exploitation probability of 0.01%, and no public proof-of-concept or in-the-wild exploitation has been reported as of publication.

Root Cause

The root cause is improper management of object lifetime within the DevTools implementation. Internal objects are referenced or destroyed in an order that violates the assumptions made by dependent components. Mapped to [CWE-1091], the defect involves the use of an object without invoking its destructor method, leaving stale references that the allocator can later reuse and corrupt.

Attack Vector

The attack vector is network-adjacent but gated by user interaction. The attacker hosts or distributes a malicious extension and convinces the victim to install it. Once active, the extension issues DevTools API calls that manipulate object lifecycles to corrupt the heap. The Chrome renderer or browser process executes the resulting controlled memory state, enabling code execution within the browser sandbox boundary.

No verified exploit code is publicly available. Technical specifics are restricted in the Chromium Issue Tracker Entry pending broader patch adoption.

Detection Methods for CVE-2026-3539

Indicators of Compromise

Installation of Chrome extensions from sources outside the Chrome Web Store or from recently registered publisher accounts
Chrome processes crashing with heap corruption signatures referencing DevTools modules
Extensions requesting debugger API permissions without a clear functional need
Unexpected child processes spawned by chrome.exe shortly after extension installation

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and flag versions of Chrome below 145.0.7632.159
Monitor Chrome crash telemetry for heap corruption faults originating in DevTools-related call stacks
Apply enterprise extension allowlisting policies and alert on installation of unapproved extension IDs
Correlate browser process anomalies with recent extension installation events in endpoint telemetry

Monitoring Recommendations

Forward Chrome crash dumps and extension installation events to a centralized analytics platform for correlation
Track outbound network connections from Chrome processes for command-and-control patterns following extension installs
Audit the ExtensionInstallForcelist and ExtensionInstallAllowlist group policies for unauthorized changes

How to Mitigate CVE-2026-3539

Immediate Actions Required

Update Google Chrome to version 145.0.7632.159 or later on all Windows, macOS, and Linux endpoints
Audit installed extensions and remove any from unverified publishers or sideloaded sources
Enforce enterprise extension management policies that restrict installation to vetted IDs
Verify that automatic browser updates are enabled and reaching managed endpoints

Patch Information

Google released the fix in the stable channel update for desktop on March 2026. Administrators should reference the Google Chrome Update Announcement for full version details and confirm deployment of Chrome 145.0.7632.159 or later.

Workarounds

Block installation of all non-allowlisted Chrome extensions through ExtensionInstallBlocklist set to *
Disable the Chrome DevTools debugger extension API for end users through enterprise policy
Restrict extension installation sources to the Chrome Web Store using ExtensionInstallSources

bash

# Configuration example - Chrome enterprise policy to restrict extensions (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v DeveloperToolsAvailability /t REG_DWORD /d 2 /f