CVE-2026-3541: Google Chrome RCE Vulnerability

CVE-2026-3541 Overview

CVE-2026-3541 is an out-of-bounds memory read vulnerability caused by an inappropriate implementation in the CSS rendering engine of Google Chrome prior to version 145.0.7632.159. A remote attacker can exploit this vulnerability by crafting a malicious HTML page that, when visited by a victim, triggers the out-of-bounds memory read condition. This could potentially allow attackers to leak sensitive memory contents or cause application instability.

Critical Impact

Attackers can remotely trigger out-of-bounds memory reads through crafted HTML pages, potentially exposing sensitive data from browser memory or facilitating further exploitation chains.

Affected Products

• Google Chrome prior to version 145.0.7632.159
• Google Chrome on Linux Kernel-based systems
• Google Chrome on Microsoft Windows
• Google Chrome on Apple macOS

Discovery Timeline

• March 4, 2026 - CVE-2026-3541 published to NVD
• March 5, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3541

Vulnerability Analysis

This vulnerability stems from an inappropriate implementation within Google Chrome's CSS processing component (CWE-284: Improper Access Control). The flaw occurs when the browser's rendering engine processes specially crafted CSS content within an HTML page. The improper implementation fails to correctly validate memory boundaries during CSS parsing and rendering operations, resulting in the browser reading memory beyond the intended buffer limits.

When a victim navigates to a malicious webpage containing the crafted HTML/CSS content, the browser's rendering engine attempts to process the malformed CSS. Due to insufficient boundary checking, the engine reads memory outside the allocated buffer space. This out-of-bounds read can potentially expose sensitive information stored in adjacent memory regions, including authentication tokens, session data, or other confidential information that may be present in the browser's memory space.

The vulnerability requires user interaction—specifically, the victim must navigate to or be redirected to a malicious webpage controlled by the attacker. This attack vector is network-based and does not require any prior authentication or elevated privileges on the target system.

Root Cause

The root cause of CVE-2026-3541 lies in improper implementation within Chrome's CSS rendering engine. The CSS parser fails to properly validate array indices or buffer boundaries when processing certain CSS constructs. This allows an attacker to craft CSS content that causes the rendering engine to access memory locations beyond the bounds of allocated data structures. The underlying issue is classified under CWE-284 (Improper Access Control), indicating a failure to properly restrict operations within the boundaries of the intended memory space.

Attack Vector

The attack vector for CVE-2026-3541 is network-based and requires user interaction. An attacker would typically:

1. Create a malicious webpage containing crafted HTML with specially constructed CSS that triggers the vulnerability
2. Distribute the malicious URL through phishing emails, malicious advertisements, compromised websites, or social engineering
3. When a victim using a vulnerable Chrome version visits the page, the browser's CSS engine processes the malicious content
4. The out-of-bounds memory read is triggered, potentially leaking sensitive data to the attacker or causing browser instability

The vulnerability does not require authentication and can be exploited against any user running an affected version of Google Chrome across Windows, macOS, and Linux platforms. For more technical details, refer to Chromium Issue Report #484811719.

Detection Methods for CVE-2026-3541

Indicators of Compromise

• Unusual Chrome browser crashes or instability when visiting specific websites
• Memory access violations or segmentation faults logged in browser crash reports
• Anomalous network traffic to unfamiliar domains serving HTML/CSS content
• Browser rendering anomalies when displaying CSS-heavy web pages

Detection Strategies

• Monitor browser crash reports for patterns indicating out-of-bounds memory access in CSS-related components
• Deploy web content filtering to identify and block known malicious URLs serving exploit payloads
• Implement endpoint detection and response (EDR) solutions capable of detecting abnormal browser memory access patterns
• Review browser telemetry for CSS rendering engine anomalies

Monitoring Recommendations

• Enable enhanced safe browsing features in Google Chrome to receive warnings about dangerous sites
• Monitor network traffic for connections to suspicious domains hosting HTML content
• Implement browser version monitoring across the organization to identify unpatched Chrome installations
• Configure SIEM alerts for Chrome crash events mentioning CSS or rendering components

How to Mitigate CVE-2026-3541

Immediate Actions Required

• Update Google Chrome to version 145.0.7632.159 or later immediately across all systems
• Enable automatic Chrome updates to ensure timely patching of future vulnerabilities
• Deploy browser isolation solutions to contain potential exploitation attempts
• Educate users about the risks of clicking untrusted links and visiting unknown websites

Patch Information

Google has released a security update addressing this vulnerability in Chrome version 145.0.7632.159. Organizations should prioritize updating all Chrome installations to this version or later. The update can be applied through Chrome's built-in update mechanism or through enterprise deployment tools for managed environments. For detailed information about the fix, refer to the Google Chrome Update Announcement.

Workarounds

• Implement strict content security policies (CSP) that restrict CSS loading from untrusted sources
• Use browser isolation technologies to execute browsing sessions in sandboxed environments
• Consider temporarily disabling JavaScript on untrusted sites as a defense-in-depth measure, though this may impact functionality
• Deploy network-level filtering to block access to known malicious domains

# Verify Chrome version and force update check
# Linux
google-chrome --version
# If version is below 145.0.7632.159, navigate to chrome://settings/help to trigger update

# Enterprise deployment - Force Chrome update via Group Policy
# Ensure the following registry key is set for automatic updates:
# HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Update\AutoUpdateCheckPeriodMinutes = 60