CVE-2026-3920
Published: 11 March 2026
Summary
CVE-2026-3920 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely identification, reporting, and correction of flaws, directly enabling patching of the out-of-bounds memory access vulnerability in Chrome's WebML component to version 146.0.7680.71.
SI-16 implements memory protection controls such as non-executable memory and address space randomization to prevent exploitation of heap corruption from out-of-bounds read/write in WebML.
RA-5 employs vulnerability scanning to identify systems running vulnerable Google Chrome versions affected by CVE-2026-3920, enabling proactive remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds memory corruption in Chrome's WebML renderer enables drive-by exploitation of a crafted HTML page (T1189) and direct client-side code execution or sandbox escape (T1203).
NVD Description
Out of bounds memory access in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-3920 is an out-of-bounds memory access vulnerability in the WebML component of Google Chrome versions prior to 146.0.7680.71. It enables potential heap corruption when processing a crafted HTML page, corresponding to CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). The issue carries a Chromium security severity rating of High and a CVSS v3.1 base score of 8.8.
A remote attacker can exploit this vulnerability without privileges by tricking a user into visiting a malicious website or interacting with a crafted HTML page, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Successful exploitation could result in high-impact confidentiality, integrity, and availability violations, such as arbitrary code execution or sandbox escape within the browser context.
Mitigation is available via the stable channel update to Google Chrome 146.0.7680.71, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_10.html. Additional technical details are provided in the Chromium issue tracker at https://issues.chromium.org/issues/482875307. Security practitioners should prioritize updating affected browsers and advise users to enable automatic updates.
Details
- CWE(s)