CVE-2026-3545: Google Chrome RCE Vulnerability

CVE-2026-3545 Overview

CVE-2026-3545 is a critical input validation vulnerability affecting Google Chrome's Navigation component. Insufficient data validation in Navigation in Google Chrome prior to version 145.0.7632.159 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability has been classified with a Chromium security severity of High and represents a significant threat to browser security.

Critical Impact

Remote attackers can potentially escape Chrome's sandbox protection by exploiting improper validation in the Navigation component, leading to potential full system compromise when users visit malicious web pages.

Affected Products

• Google Chrome prior to version 145.0.7632.159
• Google Chrome on Microsoft Windows
• Google Chrome on Linux
• Google Chrome on Apple macOS

Discovery Timeline

• March 4, 2026 - CVE-2026-3545 published to NVD
• March 5, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3545

Vulnerability Analysis

This vulnerability stems from insufficient data validation within Chrome's Navigation component. The Navigation component is responsible for handling page transitions, URL processing, and inter-frame communication within the browser. When specially crafted HTML content is processed, the lack of proper validation allows attackers to bypass security boundaries that normally isolate web content from the underlying system.

The sandbox escape capability makes this vulnerability particularly dangerous. Chrome's sandbox architecture is designed to contain malicious code within a restricted environment, preventing it from accessing system resources. By circumventing this protection, attackers can potentially execute code with the privileges of the Chrome process outside the sandbox, enabling access to the file system, other applications, and sensitive user data.

Root Cause

The root cause is classified as CWE-20 (Improper Input Validation). The Navigation component fails to properly validate input data during page navigation operations. This validation gap allows maliciously crafted HTML content to bypass expected security constraints and trigger behavior that leads to sandbox escape. The improper validation likely occurs in the handling of navigation-related data structures or URL parameters that are processed during page transitions.

Attack Vector

The attack requires network access and user interaction—specifically, a victim must navigate to a malicious webpage or be redirected to one. The attacker hosts a specially crafted HTML page designed to exploit the validation flaw. When a user visits this page, the malicious content triggers the vulnerability in Chrome's Navigation component.

Due to the changed scope characteristic of this vulnerability, a successful exploit affects resources beyond the vulnerable component's security scope. This means the attack can impact the host operating system and potentially other applications, rather than being contained within the browser's sandbox. No privileges are required from the attacker's perspective, and the exploit can be triggered through standard web browsing activity.

Detection Methods for CVE-2026-3545

Indicators of Compromise

• Unexpected Chrome renderer process crashes or abnormal process behavior
• Chrome processes attempting to access system resources outside normal browsing activity
• Unusual network connections originating from Chrome to suspicious or unknown domains
• Evidence of memory corruption or sandbox violation alerts in system security logs

Detection Strategies

• Monitor for Chrome processes spawning unexpected child processes or executing system commands
• Implement endpoint detection rules for abnormal Chrome process behavior patterns
• Review web proxy logs for access to known malicious domains hosting exploit kits
• Deploy browser-level telemetry to detect anomalous navigation events

Monitoring Recommendations

• Enable enhanced Chrome security logging in enterprise deployments
• Configure SIEM rules to correlate Chrome process anomalies with network indicators
• Monitor for exploitation attempts through SentinelOne's behavioral AI engine
• Implement web content filtering to block access to untrusted or newly registered domains

How to Mitigate CVE-2026-3545

Immediate Actions Required

• Update Google Chrome to version 145.0.7632.159 or later immediately across all systems
• Enable automatic Chrome updates to ensure timely security patch deployment
• Implement browser isolation solutions for high-risk users or sensitive environments
• Consider restricting browsing to trusted sites until patching is complete

Patch Information

Google has released Chrome version 145.0.7632.159 to address this vulnerability. Detailed information about the security update is available in the Google Chrome Stable Channel Update. Additional technical details can be found in the Chromium Issue Tracker Entry.

Organizations should prioritize deploying this update across all managed Chrome installations. Enterprise administrators using Chrome Browser Cloud Management can push the update through their management console to ensure consistent deployment.

Workarounds

• Enable Site Isolation features if not already active to add additional process-level boundaries
• Implement strict Content Security Policy headers on internal web applications
• Use network-level filtering to block access to suspicious or newly registered domains
• Consider deploying browser isolation technology for users who cannot immediately update

# Force Chrome update check on Windows via command line
"C:\Program Files\Google\Chrome\Application\chrome.exe" --check-for-update-interval=1

# Verify Chrome version after update
"C:\Program Files\Google\Chrome\Application\chrome.exe" --version

# For enterprise deployment, use Chrome policy to enforce minimum version
# In Group Policy: Computer Configuration > Administrative Templates > Google Chrome
# Set "Minimum version required" to 145.0.7632.159