CVE-2026-3539: Google Chrome Use-After-Free Vulnerability

CVE-2026-3539 Overview

CVE-2026-3539 is an object lifecycle vulnerability in the DevTools component of Google Chrome prior to version 145.0.7632.159. The flaw allows an attacker who convinces a user to install a malicious Chrome extension to trigger heap corruption through a crafted extension payload. Successful exploitation can lead to arbitrary code execution within the browser context. The issue is tracked under [CWE-1091] (Use of Object without Invoking Destructor Method) and impacts Chrome installations on Windows, macOS, and Linux. Google has rated the Chromium security severity as High and addressed the issue in the stable channel update released in March 2026.

Critical Impact

Heap corruption through a malicious extension can enable arbitrary code execution in the browser process, compromising user data and system integrity.

Affected Products

• Google Chrome versions prior to 145.0.7632.159
• Chrome installations on Microsoft Windows, Apple macOS, and Linux
• Chromium-based browsers sharing the affected DevTools component

Discovery Timeline

• 2026-03-04 - CVE-2026-3539 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-3539

Vulnerability Analysis

The vulnerability resides in the Chrome DevTools subsystem, which exposes debugging and inspection interfaces to extensions and developers. An object lifecycle defect allows a crafted Chrome Extension to manipulate the allocation and destruction sequence of internal DevTools objects. This manipulation produces heap corruption that an attacker can shape to achieve code execution within the browser process.

Exploitation requires user interaction. A victim must be persuaded to install a malicious extension from outside the standard review pipeline or from a compromised distribution channel. Once installed, the extension exercises the affected DevTools APIs to trigger the corruption without further user action.

The EPSS data indicates a current exploitation probability of 0.01%, and no public proof-of-concept or in-the-wild exploitation has been reported as of publication.

Root Cause

The root cause is improper management of object lifetime within the DevTools implementation. Internal objects are referenced or destroyed in an order that violates the assumptions made by dependent components. Mapped to [CWE-1091], the defect involves the use of an object without invoking its destructor method, leaving stale references that the allocator can later reuse and corrupt.

Attack Vector

The attack vector is network-adjacent but gated by user interaction. The attacker hosts or distributes a malicious extension and convinces the victim to install it. Once active, the extension issues DevTools API calls that manipulate object lifecycles to corrupt the heap. The Chrome renderer or browser process executes the resulting controlled memory state, enabling code execution within the browser sandbox boundary.

No verified exploit code is publicly available. Technical specifics are restricted in the Chromium Issue Tracker Entry pending broader patch adoption.

Detection Methods for CVE-2026-3539

Indicators of Compromise

• Installation of Chrome extensions from sources outside the Chrome Web Store or from recently registered publisher accounts
• Chrome processes crashing with heap corruption signatures referencing DevTools modules
• Extensions requesting debugger API permissions without a clear functional need
• Unexpected child processes spawned by chrome.exe shortly after extension installation

Detection Strategies

• Inventory installed Chrome extensions across managed endpoints and flag versions of Chrome below 145.0.7632.159
• Monitor Chrome crash telemetry for heap corruption faults originating in DevTools-related call stacks
• Apply enterprise extension allowlisting policies and alert on installation of unapproved extension IDs
• Correlate browser process anomalies with recent extension installation events in endpoint telemetry

Monitoring Recommendations

• Forward Chrome crash dumps and extension installation events to a centralized analytics platform for correlation
• Track outbound network connections from Chrome processes for command-and-control patterns following extension installs
• Audit the ExtensionInstallForcelist and ExtensionInstallAllowlist group policies for unauthorized changes

How to Mitigate CVE-2026-3539

Immediate Actions Required

• Update Google Chrome to version 145.0.7632.159 or later on all Windows, macOS, and Linux endpoints
• Audit installed extensions and remove any from unverified publishers or sideloaded sources
• Enforce enterprise extension management policies that restrict installation to vetted IDs
• Verify that automatic browser updates are enabled and reaching managed endpoints

Patch Information

Google released the fix in the stable channel update for desktop on March 2026. Administrators should reference the Google Chrome Update Announcement for full version details and confirm deployment of Chrome 145.0.7632.159 or later.

Workarounds

• Block installation of all non-allowlisted Chrome extensions through ExtensionInstallBlocklist set to *
• Disable the Chrome DevTools debugger extension API for end users through enterprise policy
• Restrict extension installation sources to the Chrome Web Store using ExtensionInstallSources

# Configuration example - Chrome enterprise policy to restrict extensions (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v DeveloperToolsAvailability /t REG_DWORD /d 2 /f