CVE-2026-3543: Google Chrome RCE Vulnerability

CVE-2026-3543 Overview

CVE-2026-3543 is a high-severity vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw stems from an inappropriate implementation in V8 that allows a remote attacker to trigger out-of-bounds memory access through a crafted HTML page. Chromium classifies the security severity as High. The issue affects Chrome versions prior to 145.0.7632.159 on Windows, macOS, and Linux platforms. Successful exploitation requires user interaction, typically by visiting an attacker-controlled web page. The vulnerability is tracked under [CWE-284] (Improper Access Control) and impacts the confidentiality, integrity, and availability of the browser process.

Critical Impact
Remote attackers can read or write memory outside intended bounds in the V8 engine by serving a crafted HTML page, enabling potential renderer compromise and sandbox-stage attacks.

Affected Products

Google Chrome prior to 145.0.7632.159 on Microsoft Windows
Google Chrome prior to 145.0.7632.159 on Apple macOS
Google Chrome prior to 145.0.7632.159 on Linux

Discovery Timeline

2026-03-04 - CVE-2026-3543 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-3543

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. An inappropriate implementation within the engine permits memory accesses that fall outside the bounds of allocated objects. When the renderer process parses attacker-controlled JavaScript embedded in an HTML page, the engine performs operations that read from or write to adjacent memory regions. This class of bug typically enables information disclosure or corruption of internal V8 structures such as backing stores, hidden classes, or inline caches. Attackers commonly chain such primitives to achieve type confusion and renderer code execution.

Root Cause

The root cause is improper enforcement of access constraints within V8 internals, mapped to [CWE-284]. The engine fails to correctly validate access boundaries during certain JavaScript operations, permitting reads and writes beyond intended object limits. Specific technical details are referenced in the Chromium Issue Tracker Entry, which is restricted pending broad patch deployment.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker hosts a crafted HTML page containing malicious JavaScript and lures a victim to visit the page. When V8 parses and executes the payload, the out-of-bounds memory access primitive is triggered inside the renderer process. Refer to the Google Chrome Update Announcement for vendor confirmation. No public proof-of-concept code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-3543

Indicators of Compromise

Chrome processes spawning unexpected child processes shortly after rendering untrusted web content
Renderer crashes with signatures referencing V8 stack frames or out-of-bounds access
Outbound connections to newly registered or low-reputation domains immediately after browser activity
Endpoints running Chrome versions earlier than 145.0.7632.159

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 145.0.7632.159
Monitor browser crash telemetry for repeated renderer faults, which often precede successful exploitation attempts
Correlate web proxy logs with endpoint process telemetry to identify navigation to suspicious HTML payloads followed by anomalous Chrome behavior

Monitoring Recommendations

Enable detailed process and network telemetry collection for browser processes
Track child process creation lineage from chrome.exe and the renderer sandbox
Alert on Chrome processes writing executables, scripts, or scheduled tasks to disk
Aggregate browser version data into centralized logging to detect non-compliant hosts

How to Mitigate CVE-2026-3543

Immediate Actions Required

Update Google Chrome to version 145.0.7632.159 or later on Windows, macOS, and Linux endpoints
Force-restart Chrome after the update to ensure the patched binary is loaded
Validate enterprise Chrome auto-update policies are enabled and functional
Audit managed devices for stale Chrome installations and remediate non-compliant hosts

Patch Information

Google released the fix in the stable channel update documented in the Google Chrome Update Announcement. The patched version is 145.0.7632.159. Administrators managing Chrome through enterprise policy should confirm the rollout reaches all endpoints. Chromium-based browsers that integrate V8 from the same upstream should also be evaluated for backports.

Workarounds

Restrict browsing to trusted sites using web filtering or DNS-based controls until patching is complete
Disable JavaScript on untrusted sites through Chrome enterprise policy for high-risk user groups
Enforce Site Isolation and the Chrome sandbox, both enabled by default, to limit renderer impact
Block access to recently registered or uncategorized domains at the network egress

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Example enterprise policy fragment (Windows registry) to restrict JavaScript
# HKLM\SOFTWARE\Policies\Google\Chrome\DefaultJavaScriptSetting = 2
# (2 = block JavaScript by default; allow trusted origins via JavaScriptAllowedForUrls)