CVE-2026-3917: Google Chrome Use After Free Vulnerability

CVE-2026-3917 Overview

CVE-2026-3917 is a use-after-free vulnerability [CWE-416] in the Agents component of Google Chrome prior to version 146.0.7680.71. A remote attacker can exploit heap corruption by enticing a user to visit a crafted HTML page. Successful exploitation can lead to arbitrary code execution within the renderer process, providing a foothold for sandbox escape and further compromise. Google rated the underlying Chromium issue as High severity. The flaw affects Chrome on Windows, macOS, and Linux desktop platforms.

Critical Impact
Remote attackers can trigger heap corruption through a crafted web page, enabling potential arbitrary code execution in the browser renderer with user interaction.

Affected Products

Google Chrome prior to 146.0.7680.71
Microsoft Windows builds running affected Chrome versions
Apple macOS and Linux builds running affected Chrome versions

Discovery Timeline

2026-03-11 - CVE-2026-3917 published to NVD
2026-03-13 - Last updated in NVD database

Technical Details for CVE-2026-3917

Vulnerability Analysis

The vulnerability is a use-after-free condition in the Agents subsystem of Chromium, the component responsible for managing scripting and execution contexts associated with frames and workers. When a referenced Agent object is freed while a pointer to it remains live, subsequent dereferences operate on reclaimed heap memory. An attacker who controls allocation patterns can place attacker-controlled data into the freed slot.

This class of bug enables heap corruption that bypasses ASLR and DEP when combined with type confusion or vtable hijacking primitives. Renderer-process compromise is the typical first stage in modern Chrome exploitation chains, generally paired with a sandbox escape to achieve full system impact.

Root Cause

The defect originates from improper object lifetime management in the Agents code path. A dangling reference persists after the underlying object has been deallocated, violating Chromium's ownership model. The condition is reachable from JavaScript and HTML executing in the renderer.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. No authentication is needed, and the attack traverses the network. User interaction is limited to navigating to the malicious page, which can be delivered via phishing, malvertising, or compromised sites.

No public proof-of-concept or in-the-wild exploitation has been reported. See the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor details.

Detection Methods for CVE-2026-3917

Indicators of Compromise

Chrome renderer process crashes with heap corruption signatures referencing the Agents component
Unexpected child process creation from chrome.exe following navigation to untrusted domains
Outbound network connections from browser processes to attacker-controlled infrastructure after a single page visit

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build below 146.0.7680.71
Monitor browser process telemetry for anomalous memory access violations or repeated renderer crashes
Correlate web proxy logs with endpoint telemetry to identify users visiting suspicious pages immediately before browser instability

Monitoring Recommendations

Enable browser crash reporting and forward dumps to a centralized analysis pipeline
Track child process lineage from Chrome to detect post-exploitation activity such as shell or LOLBin execution
Alert on Chrome processes writing executables to user-writable directories or modifying autorun locations

How to Mitigate CVE-2026-3917

Immediate Actions Required

Update Google Chrome to version 146.0.7680.71 or later on all Windows, macOS, and Linux endpoints
Restart browser sessions after patch deployment to ensure the new binary is loaded
Verify enterprise update channels are functioning and have not been disabled by group policy

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Update Announcement. Chromium-based browsers that incorporate the same upstream code should apply equivalent vendor updates as they become available.

Workarounds

Restrict browsing to trusted domains via web filtering until patches are deployed
Disable JavaScript on untrusted sites through enterprise policy to reduce reachability of the Agents code path
Apply the principle of least privilege so that browser compromise does not yield administrative access

bash

# Verify Chrome version on Linux/macOS
google-chrome --version

# Windows PowerShell version check
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Enterprise policy to enforce auto-update (Windows registry)
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f