CVE-2026-3923
Published: 11 March 2026
Summary
CVE-2026-3923 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 33.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the use-after-free flaw in Chrome's WebMIDI via software updates to version 146.0.7680.71 or later.
Implements memory protections like ASLR and DEP to prevent exploitation of heap corruption from use-after-free in the renderer process.
Provides process isolation through browser sandboxing to contain potential arbitrary code execution in the compromised WebMIDI renderer process.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free vulnerability in Chrome's WebMIDI component exploited via crafted HTML page requiring user interaction, enabling arbitrary code execution in the renderer process, directly mapping to Exploitation for Client Execution (T1203).
NVD Description
Use after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-3923 is a use-after-free vulnerability (CWE-416) in the WebMIDI component of Google Chrome prior to version 146.0.7680.71. Published on 2026-03-11, it enables potential heap corruption via a crafted HTML page, as reported with High severity by the Chromium security team. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker can exploit this vulnerability without requiring user privileges by luring victims to interact with a malicious HTML page. Successful exploitation could lead to heap corruption, granting high impacts on confidentiality, integrity, and availability, such as potential arbitrary code execution within the browser's renderer process.
Mitigation is available through the Google Chrome stable channel update to version 146.0.7680.71 or later, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_10.html. Additional technical details are provided in the Chromium issue tracker at https://issues.chromium.org/issues/485935314. Security practitioners should prioritize updating affected Chrome installations.
Details
- CWE(s)