CVE-2026-3061
Published: 23 February 2026
Summary
CVE-2026-3061 is a critical-severity Out-of-bounds Read (CWE-125) vulnerability in Google Chrome. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 22.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-3061 is an out-of-bounds read vulnerability (CWE-125) affecting the Media component in Google Chrome prior to version 145.0.7632.116. Published on 2026-02-23, it enables a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. The flaw carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) and is classified as High severity by Chromium security.
A remote attacker can exploit this vulnerability without user privileges or interaction beyond visiting a malicious site, due to its network accessibility, low attack complexity, and lack of prerequisites. Successful exploitation results in high confidentiality impact through memory disclosure and high availability impact, such as potential denial of service, while integrity remains unaffected.
Google's stable channel update for desktop Chrome addresses this issue, as documented at https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_23.html. Further technical details are available in the Chromium issue tracker at https://issues.chromium.org/issues/482862710. Security practitioners should advise updating to Chrome 145.0.7632.116 or later to mitigate the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7473
Vulnerability details
Out of bounds read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB read in Chrome Media component via crafted HTML page enables remote exploitation simply by visiting a malicious site, directly mapping to Drive-by Compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the out-of-bounds read flaw in Chrome's Media component by applying patches to version 145.0.7632.116 or later.
Provides vulnerability scanning to identify systems running vulnerable Chrome versions prior to 145.0.7632.116, enabling targeted remediation.
Implements memory safeguards like ASLR and stack canaries that mitigate exploitation of the out-of-bounds read by limiting memory disclosure and code execution.