Description
Out of bounds memory access in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Published: 2026-03-11
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Immediately
AI Analysis

Impact

Google Chrome versions prior to 146.0.7680.71 contain an out‑of‑bounds memory access flaw in WebML. A crafted HTML page can trigger heap corruption that may allow a remote attacker to execute arbitrary code. The vulnerability is classified as a high‑severity memory corruption bug, exposed through improper bounds checking (CWE‑125 and CWE‑787).

Affected Systems

The affected product is Google Chrome on all supported operating systems, including Windows, macOS, and Linux distributions, for any version earlier than 146.0.7680.71. All users running these outdated Chrome builds are susceptible through standard web browsing.

Risk and Exploitability

The CVSS score of 8.8 indicates a high risk of exploitation. Although the EPSS score is below 1%, the bug remains a serious threat given the potential impact. The vulnerability is not listed in CISA’s KEV catalog, but attackers could target browsers via malicious web content, exploiting the heap corruption to hijack execution. The likelihood of exploitation is low but notable enough to warrant immediate mitigation.

Generated by OpenCVE AI on April 16, 2026 at 02:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 146.0.7680.71 or newer. This release contains the patch for the WebML memory corruption bug.
  • If an upgrade cannot be performed promptly, disable WebML functionality via Chrome policy or command‑line flag to eliminate the attack surface.
  • Maintain all web‑related software fully updated and monitor browsers for anomalous activity following the patching step.

Generated by OpenCVE AI on April 16, 2026 at 02:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6164-1 chromium security update
History

Fri, 13 Mar 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Fri, 13 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Out of bounds memory access in WebML
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 12 Mar 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
CWE-787
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 12 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 11 Mar 2026 22:15:00 +0000

Type Values Removed Values Added
Description Out of bounds memory access in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-03-13T03:55:33.968Z

Reserved: 2026-03-11T05:54:09.895Z

Link: CVE-2026-3920

cve-icon Vulnrichment

Updated: 2026-03-12T13:06:08.211Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-11T22:16:34.507

Modified: 2026-03-13T15:43:27.333

Link: CVE-2026-3920

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-10T00:00:00Z

Links: CVE-2026-3920 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T03:00:09Z

Weaknesses