CVE-2026-3918: Google Chrome Use After Free Vulnerability

CVE-2026-3918 Overview

CVE-2026-3918 is a use-after-free vulnerability [CWE-416] in the WebMCP component of Google Chrome versions prior to 146.0.7680.71. A remote attacker can trigger heap corruption by serving a crafted HTML page, then leverage the corrupted memory state to influence program execution. The flaw affects Chrome on Windows, macOS, and Linux. Google classifies the Chromium security severity as High, and the CVSS 3.1 base score is 8.8.

Exploitation requires user interaction — the victim must navigate to attacker-controlled content. No public proof-of-concept exists at the time of writing, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A successful exploit can corrupt the Chrome renderer heap and enable arbitrary code execution within the browser process, exposing user data and serving as a foothold for sandbox escape chains.

Affected Products

Google Chrome versions prior to 146.0.7680.71 on Microsoft Windows
Google Chrome versions prior to 146.0.7680.71 on Apple macOS
Google Chrome versions prior to 146.0.7680.71 on Linux

Discovery Timeline

2026-03-10 - Google releases stable channel update for desktop addressing the flaw
2026-03-11 - CVE-2026-3918 published to NVD
2026-03-13 - Last updated in NVD database

Technical Details for CVE-2026-3918

Vulnerability Analysis

The vulnerability resides in WebMCP, a Chrome component handling Model Context Protocol interactions within the browser. A use-after-free condition occurs when code retains and dereferences a pointer to a heap object after that object has been freed. An attacker who controls heap layout can place attacker-chosen data into the reclaimed allocation, then trigger the dangling reference to read or write that data as if it were the original object.

In a browser renderer, this primitive typically grants attackers a path from heap corruption to arbitrary read/write, then to code execution within the renderer sandbox. Chained with a sandbox escape, the impact extends to the host operating system.

The Chromium issue tracker reference is Chromium Issue 483853103.

Root Cause

The root cause is improper object lifetime management in WebMCP. Code paths release a heap-allocated object while another reference remains live, violating the memory ownership contract. When that stale reference is later used, the freed memory may already contain attacker-influenced contents from a subsequent allocation.

Attack Vector

The attack vector is network-based with required user interaction. An attacker hosts a crafted HTML page that drives WebMCP into the vulnerable state. The victim triggers exploitation by visiting the page through a link, advertisement, redirect, or embedded iframe.

No authentication is required, and the page can be delivered through any standard web channel. Successful exploitation yields heap corruption with confidentiality, integrity, and availability impact rated High.

No verified exploitation code is available. The vulnerability mechanism follows the standard use-after-free exploitation pattern: trigger the free, reclaim the slot with controlled data, then invoke the dangling reference.

Detection Methods for CVE-2026-3918

Indicators of Compromise

Unexpected Chrome renderer crashes with heap corruption signatures in crash dumps, particularly stack frames referencing WebMCP code paths
Outbound connections from Chrome child processes to atypical destinations following navigation to untrusted pages
Spawning of unexpected child processes from the Chrome browser or renderer process tree

Detection Strategies

Inventory Chrome installations across endpoints and flag versions earlier than 146.0.7680.71 for prioritized remediation
Monitor browser process telemetry for renderer crashes containing WebMCP symbols, which can indicate exploitation attempts or instability
Correlate web proxy logs with endpoint browser crash events to identify pages associated with anomalous renderer behavior

Monitoring Recommendations

Forward Chrome stability and crash telemetry to a centralized SIEM for retroactive hunting against known indicators
Track post-navigation process lineage from chrome.exe to detect anomalous child processes that suggest sandbox escape
Alert on Chrome processes performing file writes outside profile directories or making unexpected network connections

How to Mitigate CVE-2026-3918

Immediate Actions Required

Update Google Chrome to version 146.0.7680.71 or later on all Windows, macOS, and Linux endpoints
Force-restart the browser after deployment to ensure the patched binary is loaded into memory
Validate update compliance through endpoint management tooling and quarantine non-compliant systems from sensitive network segments

Patch Information

Google addressed the vulnerability in the stable channel update for desktop announced in the Chrome Releases Blog. Administrators should deploy Chrome 146.0.7680.71 or later. Enterprises using Chrome Browser Cloud Management or group policy can accelerate rollout by setting the TargetVersionPrefix policy.

Workarounds

Restrict browsing to trusted sites through web filtering policies until the patch is deployed
Disable or block features that exercise WebMCP code paths where enterprise policy permits
Apply browser hardening policies such as Site Isolation and strict third-party cookie blocking to reduce exposure to crafted pages

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion