CVE-2026-3915
Published: 11 March 2026
Summary
CVE-2026-3915 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 23.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of flaws like this heap buffer overflow by patching Chrome to version 146.0.7680.71 or later.
Implements memory protections such as address space layout randomization and data execution prevention to directly mitigate heap buffer overflow vulnerabilities enabling out-of-bounds reads.
Enforces process isolation through sandboxing to limit the scope and impact of exploitation from the WebML heap buffer overflow within Chrome's renderer processes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in Chrome WebML component is directly triggered by rendering a crafted HTML page from a malicious site, enabling drive-by compromise (T1189) and exploitation for client execution (T1203) with high C/I/A impact.
NVD Description
Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-3915 is a heap buffer overflow vulnerability (CWE-122) in the WebML component of Google Chrome prior to version 146.0.7680.71. The flaw enables a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. It carries a Chromium security severity rating of High and a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker without privileges can exploit this vulnerability by luring a user to visit a malicious website hosting the crafted HTML page, requiring user interaction such as clicking or rendering the page. Exploitation could grant high-impact access to sensitive memory contents, with potential effects on confidentiality, integrity, and availability.
Google addressed the issue in Chrome stable channel version 146.0.7680.71. Further details on the patch and update are available in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_10.html and the Chromium issue tracker at https://issues.chromium.org/issues/483971526.
Details
- CWE(s)