Cyber Posture

CVE-2026-3061

Critical

Published: 23 February 2026

Published
23 February 2026
Modified
25 February 2026
KEV Added
Patch
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS Score 0.0003 10.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-3061 is a critical-severity Out-of-bounds Read (CWE-125) vulnerability in Google Chrome. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 10.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).

Threat & Defense at a Glance

What attackers do: exploitation maps to Drive-by Compromise (T1189). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires timely remediation of the out-of-bounds read flaw in Chrome's Media component by applying patches to version 145.0.7632.116 or later.

detect

Provides vulnerability scanning to identify systems running vulnerable Chrome versions prior to 145.0.7632.116, enabling targeted remediation.

prevent

Implements memory safeguards like ASLR and stack canaries that mitigate exploitation of the out-of-bounds read by limiting memory disclosure and code execution.

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
Why these techniques?

OOB read in Chrome Media component via crafted HTML page enables remote exploitation simply by visiting a malicious site, directly mapping to Drive-by Compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Out of bounds read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

Deeper analysisAI

CVE-2026-3061 is an out-of-bounds read vulnerability (CWE-125) affecting the Media component in Google Chrome prior to version 145.0.7632.116. Published on 2026-02-23, it enables a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. The flaw carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) and is classified as High severity by Chromium security.

A remote attacker can exploit this vulnerability without user privileges or interaction beyond visiting a malicious site, due to its network accessibility, low attack complexity, and lack of prerequisites. Successful exploitation results in high confidentiality impact through memory disclosure and high availability impact, such as potential denial of service, while integrity remains unaffected.

Google's stable channel update for desktop Chrome addresses this issue, as documented at https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_23.html. Further technical details are available in the Chromium issue tracker at https://issues.chromium.org/issues/482862710. Security practitioners should advise updating to Chrome 145.0.7632.116 or later to mitigate the vulnerability.

Details

CWE(s)

Affected Products

google
chrome
≤ 145.0.7632.116 · ≤ 145.0.7632.117

CVEs Like This One

CVE-2026-5913Same product: Apple Macos
CVE-2026-5282Same product: Apple Macos
CVE-2026-4462Same product: Apple Macos
CVE-2026-4674Same product: Apple Macos
CVE-2026-3540Same product: Apple Macos
CVE-2026-4677Same product: Apple Macos
CVE-2026-3926Same product: Apple Macos
CVE-2026-4460Same product: Apple Macos
CVE-2026-5292Same product: Apple Macos
CVE-2026-4439Same product: Apple Macos

References