CVE-2026-3542 Overview
CVE-2026-3542 is a high-severity vulnerability in the WebAssembly (Wasm) implementation of Google Chrome prior to version 145.0.7632.159. The flaw allows a remote attacker to trigger out-of-bounds memory access by serving a crafted HTML page to a target browser. Google classifies the Chromium security severity as High. The weakness is categorized under CWE-284: Improper Access Control.
The vulnerability affects Chrome on Windows, macOS, and Linux. Successful exploitation requires user interaction, specifically navigating to a malicious page. Attackers can leverage the bug to read or write memory outside intended bounds within the renderer process, potentially leading to information disclosure or further memory corruption chained with a sandbox escape.
Critical Impact
Remote attackers can trigger out-of-bounds memory access in the Chrome renderer via crafted HTML, threatening confidentiality, integrity, and availability of the browser process.
Affected Products
- Google Chrome versions prior to 145.0.7632.159 on Microsoft Windows
- Google Chrome versions prior to 145.0.7632.159 on Apple macOS
- Google Chrome versions prior to 145.0.7632.159 on Linux
Discovery Timeline
- 2026-03-04 - CVE-2026-3542 published to NVD
- 2026-03-05 - Last updated in NVD database
Technical Details for CVE-2026-3542
Vulnerability Analysis
The vulnerability resides in Chrome's WebAssembly engine, which compiles and executes Wasm bytecode inside the renderer process. An inappropriate implementation in the Wasm pipeline permits operations that access memory outside the declared linear memory or stack bounds. The defect is tracked under Chromium Issue #485152421.
Out-of-bounds access in a JIT-compiled environment provides a primitive that attackers can shape into more powerful exploitation patterns. Researchers commonly chain such primitives with type confusion or sandbox bypass bugs to escalate to remote code execution. The bug requires only that the victim load attacker-controlled HTML that embeds or fetches a malicious Wasm module.
Root Cause
The root cause is an improper access control condition [CWE-284] in WebAssembly module handling. The implementation fails to correctly enforce boundary checks under specific Wasm code paths, allowing reads or writes to fall outside the intended memory region. Detailed code-level analysis is restricted in the upstream Chromium issue tracker until broad patch adoption is achieved.
Attack Vector
Attack delivery occurs entirely over the network. An attacker hosts a crafted HTML page that loads a malicious WebAssembly module. When a victim visits the page using a vulnerable Chrome build, the Wasm engine processes the module and triggers the out-of-bounds access. No authentication is required, but the victim must navigate to the page or be redirected to it through advertising, phishing, or compromised sites.
A technical proof-of-concept has not been publicly released. See the Chromium Issue Tracker #485152421 for upstream details once access restrictions are lifted.
Detection Methods for CVE-2026-3542
Indicators of Compromise
- Chrome renderer process crashes with access violation or segmentation faults correlated with Wasm execution.
- Outbound connections from browser hosts to unfamiliar domains serving .wasm content shortly before crash events.
- Unexpected child processes spawned from chrome.exe or the renderer helper on macOS and Linux.
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any build below 145.0.7632.159 as vulnerable.
- Monitor endpoint telemetry for renderer crash signatures, Wasm-related stack traces, and anomalous memory faults in Chrome processes.
- Inspect web proxy logs for requests to .wasm resources from low-reputation domains and correlate with browser sessions.
Monitoring Recommendations
- Forward Chrome crash dumps and process telemetry to a centralized analytics platform for trend analysis.
- Alert on combinations of new domain visits, Wasm content delivery, and subsequent renderer instability on the same host.
- Track DNS and HTTP egress for indicators of drive-by exploitation campaigns targeting browser vulnerabilities.
How to Mitigate CVE-2026-3542
Immediate Actions Required
- Update Google Chrome to version 145.0.7632.159 or later on Windows, macOS, and Linux endpoints.
- Force restart Chrome after the update so the patched binary is loaded into memory.
- Verify Chromium-based enterprise browsers and embedded WebViews receive the equivalent upstream fix.
Patch Information
Google released the fix in the Stable channel update referenced in the Google Chrome Stable Update advisory. Administrators should validate that managed devices pull the new version through Chrome's auto-update mechanism or via enterprise deployment tooling.
Workarounds
- Disable WebAssembly via enterprise policy where business requirements permit, using the DefaultJavaScriptJitSetting and related Wasm controls.
- Restrict browsing to vetted domains through web filtering until patch deployment is verified across the fleet.
- Apply Chrome enterprise policies that block execution of Wasm on untrusted origins through site-list controls.
# Verify installed Chrome version on Linux
google-chrome --version
# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
