CVE-2026-3921: Google Chrome Use After Free Vulnerability

CVE-2026-3921 Overview

CVE-2026-3921 is a use-after-free vulnerability in the TextEncoding component of Google Chrome prior to version 146.0.7680.71. A remote attacker can trigger heap corruption by serving a crafted HTML page to a victim. Successful exploitation requires user interaction, such as visiting an attacker-controlled website. The flaw is classified under CWE-416: Use After Free and Google rates the Chromium security severity as High. Affected installations span Chrome on Windows, macOS, and Linux desktop platforms.

Critical Impact

Remote attackers can corrupt heap memory through a malicious web page, potentially leading to arbitrary code execution within the Chrome renderer process.

Affected Products

• Google Chrome prior to 146.0.7680.71 on Microsoft Windows
• Google Chrome prior to 146.0.7680.71 on Apple macOS
• Google Chrome prior to 146.0.7680.71 on Linux

Discovery Timeline

• 2026-03-11 - CVE-2026-3921 published to NVD
• 2026-03-13 - Last updated in NVD database

Technical Details for CVE-2026-3921

Vulnerability Analysis

The vulnerability resides in Chrome's TextEncoding implementation, which handles character set conversion when processing HTML and JavaScript content. A use-after-free condition occurs when the browser continues to reference a memory region after it has been freed. An attacker who controls the lifecycle of an encoded text object can reclaim that memory with attacker-controlled data before the stale pointer is dereferenced.

Exploitation requires the victim to load a crafted HTML page. Because rendering occurs in the sandboxed renderer process, attackers typically chain this flaw with a sandbox escape to achieve full system compromise. The user interaction requirement does not meaningfully reduce risk, since drive-by browsing and malvertising readily satisfy that condition.

Root Cause

The root cause is improper object lifetime management within the TextEncoding code path. The component frees an internal buffer or object while another code path retains a reference to it. Subsequent operations dereference the dangling pointer, allowing attacker-controlled data placed in the reclaimed allocation to influence program state. This pattern frequently enables read/write primitives that lead to heap corruption and remote code execution in the renderer.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker hosts a malicious HTML page that constructs specific text encoding operations to trigger the freed-object reuse. Delivery methods include direct links, phishing, compromised websites, and malicious advertisements served through ad networks. The crafted page manipulates JavaScript and DOM operations to align heap allocations with the use-after-free window.

No public proof-of-concept has been released, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details remain restricted in the Chromium Issue Tracker entry, consistent with Google's practice of limiting access until a majority of users have updated.

Detection Methods for CVE-2026-3921

Indicators of Compromise

• Chrome renderer process crashes with heap corruption signatures originating from blink::TextCodec or related encoding modules
• Unexpected child processes spawned by chrome.exe or the Chrome helper process following web navigation
• Outbound connections from Chrome renderer processes to uncategorized or newly registered domains hosting obfuscated JavaScript
• Browser telemetry showing repeated visits to pages that aggressively manipulate TextDecoder or TextEncoder APIs

Detection Strategies

• Inventory installed Chrome versions across the fleet and flag any host running a build earlier than 146.0.7680.71
• Monitor endpoint telemetry for anomalous memory access violations and crash dumps tied to the Chrome renderer
• Inspect web proxy logs for HTML responses containing unusual sequences of encoding declarations or scripted decoder allocations
• Correlate browser crash events with subsequent process creation or network anomalies on the same host

Monitoring Recommendations

• Enable Chrome enterprise reporting to surface version data and crash reports to a central console
• Forward endpoint, proxy, and DNS logs to a centralized analytics platform for cross-source correlation
• Track exploitation discussions and indicator releases tied to CVE-2026-3921 through threat intelligence feeds
• Alert when Chrome processes write to or execute from non-standard directories after browsing activity

How to Mitigate CVE-2026-3921

Immediate Actions Required

• Update Google Chrome to version 146.0.7680.71 or later on all Windows, macOS, and Linux endpoints
• Force-restart the browser after deployment so the patched binary is loaded into memory
• Verify automatic update channels are functioning and not blocked by network or policy restrictions
• Prioritize patching for users who handle sensitive data or browse external sites frequently

Patch Information

Google released the fix in the Chrome Stable channel update referenced in the Stable Channel Update for Desktop. Administrators should confirm endpoints report version 146.0.7680.71 or later. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi typically inherit the same fix and should be updated to their corresponding patched releases.

Workarounds

• Deploy enterprise policy to disable JavaScript on untrusted sites until patching completes
• Route browsing through a remote browser isolation solution for high-risk user groups
• Restrict access to uncategorized and newly registered domains at the web proxy
• Enforce site isolation and the strictest available Chrome security settings via group policy

# Verify Chrome version on Linux
google-chrome --version

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version