CVE-2026-3543: Google Chrome V8 RCE Vulnerability

CVE-2026-3543 Overview

CVE-2026-3543 is a high-severity vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw stems from an inappropriate implementation that allows a remote attacker to potentially perform out-of-bounds memory access through a crafted HTML page. V8 is Chrome's core JavaScript and WebAssembly execution engine, making this vulnerability particularly concerning as it could be exploited simply by visiting a malicious website.

Critical Impact

Remote attackers can potentially achieve out-of-bounds memory access via malicious web content, which could lead to information disclosure, browser crashes, or potentially arbitrary code execution within the browser sandbox.

Affected Products

• Google Chrome versions prior to 145.0.7632.159
• Google Chrome on Linux
• Google Chrome on Microsoft Windows
• Google Chrome on Apple macOS

Discovery Timeline

• March 4, 2026 - CVE-2026-3543 published to NVD
• March 5, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3543

Vulnerability Analysis

This vulnerability is classified as CWE-284 (Improper Access Control) and affects the V8 JavaScript engine in Google Chrome. The inappropriate implementation allows attackers to craft malicious HTML pages that trigger out-of-bounds memory access when processed by the browser. V8 is responsible for compiling and executing JavaScript code, and flaws in its implementation can have severe security implications.

The attack requires user interaction—specifically, a victim must navigate to a malicious webpage containing the specially crafted content. Once triggered, the vulnerability enables memory access outside the bounds of allocated buffers, which could potentially be leveraged to read sensitive information from memory, corrupt data, or achieve code execution within the renderer process.

Root Cause

The vulnerability originates from an inappropriate implementation within the V8 engine's memory handling logic. When processing certain JavaScript operations or WebAssembly code embedded in HTML pages, the engine fails to properly validate memory boundaries, allowing access to memory regions outside the intended allocation. This type of flaw typically occurs when optimizations in the JIT (Just-In-Time) compiler introduce unsafe assumptions about array bounds or object properties.

Attack Vector

The attack is network-based and requires user interaction. An attacker must host or inject malicious content into a webpage and entice a victim to visit it. The attack flow typically follows these steps:

1. The attacker crafts a malicious HTML page containing JavaScript code designed to exploit the V8 implementation flaw
2. The victim navigates to the attacker-controlled or compromised webpage
3. Chrome's V8 engine processes the malicious JavaScript
4. The inappropriate implementation triggers out-of-bounds memory access
5. The attacker can potentially leverage this access for information disclosure or further exploitation

The vulnerability can be exploited through various delivery mechanisms including phishing emails with malicious links, compromised websites, malicious advertisements, or watering hole attacks targeting specific user groups.

Detection Methods for CVE-2026-3543

Indicators of Compromise

• Unusual Chrome renderer process crashes or unexpected browser termination when visiting specific websites
• Memory access violation errors in Chrome crash logs referencing V8 components
• Anomalous JavaScript execution patterns in browser debugging tools
• Unexpected network connections following visits to unfamiliar websites

Detection Strategies

• Monitor for Chrome crash reports containing V8-related memory access violations
• Implement network security tools to detect and block known malicious pages exploiting this vulnerability
• Deploy endpoint detection and response (EDR) solutions capable of monitoring browser process behavior
• Use SentinelOne Singularity platform to detect anomalous process behavior stemming from browser exploitation

Monitoring Recommendations

• Enable Chrome's built-in Safe Browsing feature to receive warnings about dangerous sites
• Configure centralized logging for browser crash events across the enterprise
• Monitor for Chrome processes spawning unexpected child processes or making unusual system calls
• Implement DNS filtering to block access to known malicious domains

How to Mitigate CVE-2026-3543

Immediate Actions Required

• Update Google Chrome to version 145.0.7632.159 or later immediately
• Enable automatic Chrome updates to ensure timely security patches
• Verify the Chrome version across all systems using chrome://settings/help
• Consider using enterprise browser management tools to enforce version requirements

Patch Information

Google has released a security update addressing this vulnerability in Chrome version 145.0.7632.159. The patch is available through standard Chrome update channels. Organizations can review the official security bulletin at the Google Chrome Releases Blog for detailed information about this and other vulnerabilities addressed in this release.

Additional technical details may be available through the Chromium Issue Tracker.

Workarounds

• Restrict access to untrusted websites through web filtering solutions until patching is complete
• Consider temporarily using an alternative browser for high-risk browsing activities
• Implement strict Content Security Policy (CSP) headers on internal web applications to reduce attack surface
• Enable Site Isolation features in Chrome to limit the impact of potential exploitation

# Verify Chrome version and update status
# On Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion

# On Linux
google-chrome --version

# On macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force Chrome update check
# Navigate to chrome://settings/help in the browser address bar