CVE-2026-3544: Google Chrome Buffer Overflow Vulnerability

CVE-2026-3544 Overview

A heap buffer overflow vulnerability has been identified in the WebCodecs component of Google Chrome prior to version 145.0.7632.159. This memory corruption flaw allows a remote attacker to perform an out-of-bounds memory write by tricking a user into visiting a specially crafted HTML page. The vulnerability exists in Chrome's implementation of the WebCodecs API, which provides low-level access to individual frames of a video stream and chunks of audio, making it a critical component for media processing in web applications.

Critical Impact

Remote attackers can achieve arbitrary code execution with user privileges by exploiting this heap buffer overflow through malicious web content, potentially leading to complete system compromise.

Affected Products

• Google Chrome versions prior to 145.0.7632.159
• Google Chrome on Microsoft Windows
• Google Chrome on Apple macOS
• Google Chrome on Linux

Discovery Timeline

• 2026-03-04 - CVE-2026-3544 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-3544

Vulnerability Analysis

This vulnerability is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). The flaw resides in the WebCodecs API implementation within Google Chrome's rendering engine. WebCodecs provides web developers with efficient access to built-in media encoders and decoders, enabling use cases like video editing, video conferencing, and media streaming directly in the browser.

The heap buffer overflow occurs when Chrome improperly handles certain crafted media data processed through the WebCodecs interface. When a victim visits a malicious webpage containing specially crafted HTML and JavaScript code that manipulates WebCodecs API calls, the browser fails to properly validate buffer boundaries during memory operations, allowing an attacker to write data beyond the allocated heap buffer.

Root Cause

The root cause stems from insufficient bounds checking in the WebCodecs component when processing media frames. The vulnerability allows memory corruption on the heap, which can be leveraged to overwrite critical data structures or function pointers. Since the attack requires user interaction (visiting a malicious page), successful exploitation depends on social engineering or embedding the exploit in compromised legitimate websites.

Attack Vector

The attack is network-based and requires user interaction. An attacker must convince a target to navigate to a malicious webpage or inject malicious content into a legitimate site that the victim visits. The crafted HTML page triggers the vulnerable code path in WebCodecs, causing heap corruption that can be exploited for arbitrary code execution.

The exploitation flow involves serving malicious media content through crafted WebCodecs API calls that trigger the buffer overflow condition. Due to the nature of heap corruption vulnerabilities in modern browsers, successful exploitation typically requires defeating additional mitigations such as ASLR and heap randomization. See the Chromium Issue Tracker Entry for additional technical details.

Detection Methods for CVE-2026-3544

Indicators of Compromise

• Unusual Chrome renderer process crashes, particularly when processing media content
• Abnormal memory allocation patterns in Chrome's WebCodecs component
• Suspicious network traffic to domains hosting crafted media content
• Evidence of exploitation attempts in browser crash reports referencing WebCodecs

Detection Strategies

• Monitor Chrome version deployments across endpoints to identify unpatched instances below 145.0.7632.159
• Implement browser-level telemetry to detect anomalous WebCodecs API usage patterns
• Deploy network-based detection for suspicious HTML pages with unusual media encoding characteristics
• Configure endpoint detection rules to alert on Chrome renderer crashes with heap corruption signatures

Monitoring Recommendations

• Enable Chrome crash reporting and monitor for WebCodecs-related memory violations
• Review web proxy logs for access to known malicious domains exploiting browser vulnerabilities
• Implement SentinelOne's behavioral AI to detect post-exploitation activities following browser compromise
• Monitor for unauthorized child process spawning from Chrome renderer processes

How to Mitigate CVE-2026-3544

Immediate Actions Required

• Update Google Chrome to version 145.0.7632.159 or later immediately across all endpoints
• Enable automatic Chrome updates to ensure timely deployment of security patches
• Consider disabling or restricting WebCodecs API access through Chrome enterprise policies until patching is complete
• Alert users about the risks of visiting untrusted websites during the remediation window

Patch Information

Google has addressed this vulnerability in Chrome version 145.0.7632.159. Organizations should update all Chrome installations immediately. The Google Chrome Stable Update provides official patch details.

For enterprise environments, administrators can deploy updates through Chrome Browser Cloud Management or Group Policy Objects on Windows. The update addresses the heap buffer overflow by implementing proper bounds checking in the WebCodecs media processing routines.

Workarounds

• Temporarily disable JavaScript on untrusted sites to prevent WebCodecs API exploitation
• Use Chrome enterprise policies to restrict access to the WebCodecs API: --disable-features=WebCodecs
• Implement network-level filtering to block known malicious domains targeting this vulnerability
• Consider using alternative browsers temporarily while awaiting Chrome patch deployment

# Chrome enterprise policy to disable WebCodecs (Windows Registry)
REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome" /v WebCodecsEnabled /t REG_DWORD /d 0 /f

# Verify Chrome version to ensure patch is applied
google-chrome --version
# Expected output: Google Chrome 145.0.7632.159 or higher