CVE-2026-3917
Published: 11 March 2026
Summary
CVE-2026-3917 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 26.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-3917 is a use-after-free vulnerability (CWE-416) affecting the Agents component in Google Chrome prior to version 146.0.7680.71. This flaw enables a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High severity by Chromium security standards.
A remote attacker without privileges can exploit this vulnerability over the network with low attack complexity, though it requires user interaction, such as convincing a user to visit a malicious website. Successful exploitation could lead to heap corruption, potentially allowing arbitrary code execution with high impacts on confidentiality, integrity, and availability.
Google addressed this vulnerability in Chrome version 146.0.7680.71. Practitioners should advise users to update immediately. Further details are provided in the Chrome stable channel update at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_10.html and the Chromium issue tracker at https://issues.chromium.org/issues/483569512.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11426
Vulnerability details
Use after free in Agents in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free vulnerability in Chrome exploited via crafted HTML page enables remote code execution through client-side exploitation (T1203) and drive-by compromise by luring users to malicious websites (T1189).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the use-after-free vulnerability by requiring timely identification, reporting, and correction via the Chrome patch to version 146.0.7680.71.
Implements security safeguards such as ASLR and DEP to protect against unauthorized code execution due to memory address misuse like use-after-free leading to heap corruption.
Enforces process isolation through browser sandboxing to contain potential exploitation of heap corruption within isolated processes.