CVE-2026-3915: 
vulnerability analysis and mitigation

CVE-2026-3915 is a heap buffer overflow vulnerability in the WebML component of Google Chrome that allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. It was reported by Tobias Wienand on February 12, 2026, and publicly disclosed on March 10–11, 2026, as part of the Chrome 146 stable channel release. Affected versions include all Google Chrome releases prior to 146.0.7680.71, as well as Microsoft Edge (Chromium-based). The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Chrome Releases, Microsoft MSRC).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow) and resides in Chrome's WebML component, which handles machine learning inference tasks within the browser. Insufficient bounds checking during WebML operations allows a heap buffer overflow condition, enabling an attacker to read memory beyond the allocated buffer. Exploitation requires the victim to visit a specially crafted HTML page, making user interaction a prerequisite. The Chromium issue tracker references bug ID 483971526 for this vulnerability (Chrome Releases).

Successful exploitation can expose sensitive data residing in heap memory, including authentication tokens, encryption keys, or other in-process secrets, due to the out-of-bounds memory read primitive. The CVSS score reflects high impacts to confidentiality, integrity, and availability, suggesting the vulnerability may also be leveraged as a stepping stone toward more severe exploitation such as arbitrary code execution. All users running Chrome prior to 146.0.7680.71 on Windows, Mac, Linux, and ChromeOS are within the affected scope, as are users of Chromium-based Microsoft Edge (Chrome Releases, Microsoft MSRC).

1. Reconnaissance: Identify targets running Google Chrome versions prior to 146.0.7680.71 on any supported platform (Windows, Mac, Linux, ChromeOS).
2. Craft malicious HTML page: Develop an HTML page that triggers the WebML component with inputs designed to cause a heap buffer overflow — for example, by invoking WebML APIs (such as the Web Neural Network API) with malformed or oversized tensor data.
3. Deliver the page: Host the crafted HTML page on an attacker-controlled server or inject it via a compromised website, phishing email, or malicious advertisement.
4. Induce user interaction: Lure the victim into visiting the malicious URL using social engineering (e.g., phishing, malvertising).
5. Trigger out-of-bounds read: When the victim's browser processes the page, the WebML component reads beyond the allocated heap buffer, potentially leaking sensitive memory contents (e.g., tokens, keys) back to the attacker via JavaScript-accessible side channels or error responses.
6. Escalate (optional): Use leaked memory data to bypass ASLR or other mitigations, potentially chaining with additional vulnerabilities for full code execution (Chrome Releases).

• Network: Unusual outbound HTTP/HTTPS requests from the browser process to unknown or newly registered domains; connections initiated shortly after visiting an unfamiliar webpage.
• Logs: Browser crash reports or renderer process crashes (found in chrome://crashes or system crash logs) associated with WebML or GPU process activity; unexpected chrome_renderer or chrome_gpu process terminations.
• Process: Unexpected child processes spawned by the Chrome renderer or GPU process; anomalous memory usage spikes in Chrome renderer processes when loading specific pages.
• File System: Unexpected files written to the Chrome user data directory or temporary directories by the renderer process.

Google has released Chrome 146.0.7680.71 (Linux) and 146.0.7680.71/72 (Windows/Mac) to address this vulnerability; users should update immediately via Chrome's built-in update mechanism (chrome://settings/help) (Chrome Releases). Microsoft Edge (Chromium-based) users should apply the corresponding Edge update from Microsoft (Microsoft MSRC). Linux distribution users (Debian, Fedora, openSUSE) should apply the Chromium package updates provided by their respective distribution maintainers. As a temporary workaround, organizations can restrict access to untrusted websites and educate users to avoid clicking suspicious links until patching is complete.

The Chrome 146 release received broad coverage from security media outlets including GBHackers, CyberSecurityNews, Heise, and PCWorld, with several noting the significance of the WebML-related vulnerabilities patched in this update (GBHackers, Heise). PCWorld specifically highlighted the broader Chrome 146 update in the context of zero-day patching activity (PCWorld). The bug bounty reward of $43,000 for CVE-2026-3915 — matching the payout for CVE-2026-3914 — underscores Google's assessment of its severity (Chrome Releases).