CVE-2026-3539

Google · Chrome

Google Chrome versions prior to 145 are vulnerable to an object lifecycle flaw within the DevTools component, potentially leading to memory corruption or arbitrary code execution.

Executive summary

A high-severity object lifecycle issue in Google Chrome's DevTools could allow an attacker to compromise the browser environment, leading to potential data theft or system instability.

Vulnerability

This vulnerability involves an "object lifecycle" issue within the DevTools engine. Such flaws typically occur when the browser incorrectly manages the memory or state of an object, which can be exploited to achieve use-after-free conditions or other memory corruption states.

Business impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to endpoint security. Exploitation could lead to the compromise of the user's browser session, theft of sensitive information (such as session cookies or credentials), or the execution of malicious code. Given Chrome's ubiquity, this poses a widespread risk to corporate data and user privacy.

Remediation

Immediate Action: Update Google Chrome to version 145 or later across all enterprise workstations immediately.

Proactive Monitoring: Utilize endpoint detection and response (EDR) tools to monitor for unusual browser behavior or crashes that may indicate exploitation attempts.

Compensating Controls: Implement browser isolation technologies or restrict the use of developer tools through Group Policy Objects (GPO) for non-technical staff to reduce the attack surface.

Exploitation status

Public Exploit Available: false

Analyst recommendation

The high CVSS score and the critical nature of browser security make this a priority for remediation. IT administrators should use automated patch management systems to ensure all instances of Google Chrome are updated to version 145 or higher without delay.