CVE-2026-3540

8.8

Google · Chrome

A memory safety flaw in the Google Chrome WebAudio component allows remote attackers to perform out of bounds memory access using a specially crafted HTML page.

Executive summary

A high-severity memory corruption vulnerability in Google Chrome allows remote attackers to trigger out of bounds memory access, potentially leading to system compromise.

Vulnerability

The vulnerability is an inappropriate implementation within the WebAudio component that permits unauthenticated remote attackers to achieve out of bounds memory access via malicious web content.

Business impact

Successful exploitation of this flaw could allow an attacker to bypass browser security boundaries, potentially leading to arbitrary code execution or unauthorized data access. Given the CVSS score of 8.8, this represents a significant risk to organizational endpoints, as the attack requires only that a user visits a malicious site. Such incidents can result in severe data breaches and loss of control over compromised workstations.

Remediation

Immediate Action: Update Google Chrome to version 145.0.7632.159 or later immediately.

Proactive Monitoring: Monitor browser-related security logs and endpoint telemetry for unusual process behavior or crashes associated with the Chrome browser.

Compensating Controls: Deploy endpoint protection solutions that can detect and block memory exploitation attempts, and utilize browser-based security policies to restrict untrusted scripts.

Exploitation status

Public Exploit Available: Unknown

Analyst recommendation

This vulnerability presents a high risk to users and organizational infrastructure due to the ease of remote exploitation through standard web browsing. System administrators must prioritize the deployment of the latest Chrome version across all managed devices to ensure that the memory safety protections in the WebAudio component are correctly implemented and patched.

More Google CVEs

Sources