CVE-2026-3913
Published: 11 March 2026
Summary
CVE-2026-3913 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 33.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-3913 is a heap buffer overflow vulnerability in the WebML component of Google Chrome prior to version 146.0.7680.71. The flaw enables a remote attacker to potentially exploit heap corruption via a crafted HTML page. It is linked to CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and Chromium rates its security severity as Critical.
A remote attacker can exploit this vulnerability by enticing a user to visit a malicious website hosting the crafted HTML page, requiring user interaction but no privileges. Exploitation could lead to heap corruption, resulting in high-impact compromises to confidentiality, integrity, and availability, such as potential arbitrary code execution.
Mitigation is provided in Google Chrome version 146.0.7680.71 and later, as outlined in the stable channel update for desktop at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_10.html. Additional technical details are available in the Chromium issue tracker at https://issues.chromium.org/issues/483445078.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11418
Vulnerability details
Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in Chrome WebML enables remote code execution via crafted HTML on malicious site (T1189 Drive-by Compromise) and direct client-side exploitation for arbitrary code execution (T1203 Exploitation for Client Execution).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of flaws, such as installing the Chrome patch version 146.0.7680.71, to eliminate the heap buffer overflow vulnerability in WebML.
Implements memory protections like ASLR and DEP to prevent successful exploitation of heap corruption from crafted HTML pages in WebML.
Enforces process isolation through browser sandboxing to contain potential heap overflow exploits within the renderer process, limiting system compromise.