CVE-2026-3919
Published: 11 March 2026
Summary
CVE-2026-3919 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 10.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely flaw remediation by patching the use-after-free vulnerability in Chrome extensions to version 146.0.7680.71 or later.
Prohibits or controls user-installed software, preventing the installation of the malicious extension required to trigger the vulnerability.
Implements memory protections that mitigate heap corruption resulting from the use-after-free in Chrome extensions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome Extensions component enables arbitrary code execution in renderer process after malicious extension install + crafted HTML page, directly mapping to client-side exploitation for execution.
NVD Description
Use after free in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-3919 is a use-after-free vulnerability (CWE-416) in the Extensions component of Google Chrome prior to version 146.0.7680.71. The flaw allows an attacker who convinces a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. It carries a Chromium security severity rating of High and a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
An attacker can exploit this vulnerability remotely over the network with low complexity and no required privileges, but it necessitates user interaction in the form of installing a malicious extension. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, such as heap corruption leading to arbitrary code execution within the browser's renderer process.
Mitigation details are available in the Chrome Releases stable channel update announcement at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_10.html and the associated Chromium issue tracker at https://issues.chromium.org/issues/444176961. The vulnerability is fixed in Google Chrome 146.0.7680.71, and users should update to this version or later to address the issue.
Details
- CWE(s)