Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to vulnerabilities
High

Out-of-bounds memory access in V8 in Google Chrome

IdentifiersCVE-2026-3543CWE-787

CVE-2026-3543 is a High-severity vulnerability in V8, the JavaScript and WebAssembly engine used by Google Chrome. According to the provided content, the issue is described as an inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 that allows a remote attacker to potentially trigger out-of-bounds memory access via a crafted HTML page. The flaw affects Chrome/Chromium builds before the fixed 145.0.7632.159 release line. The available information does not identify the specific vulnerable function or code path within V8.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial
ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation could allow a remote attacker to induce out-of-bounds memory access in the browser process by convincing a target to load a crafted HTML page. Based on the provided Chromium package context, resulting impacts may include browser crash/denial of service, information disclosure, or potentially arbitrary code execution depending on exploitability and surrounding mitigations. The provided content does not confirm active exploitation.

Mitigation

If you can’t patch tonight, do this now.

Apply the vendor update as soon as possible. Until patching is complete, reduce exposure by limiting use of untrusted websites and untrusted web content, especially in environments where Chrome is used to process externally supplied HTML. Enterprise defenders should prioritize rapid rollout of the fixed browser version and monitor for browser crashes or anomalous renderer behavior associated with malicious web content. No specific workaround beyond updating is provided in the supplied content.

Remediation

Patch, then assume compromise.

Update Google Chrome/Chromium to version 145.0.7632.159 or later. The provided advisory context states that Chrome Stable was updated to 145.0.7632.159/160 on Windows and macOS and 145.0.7632.159 on Linux, and that enterprise administrators should deploy the update across managed endpoints via policy.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
GoogleChromeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Start free trial
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES
MITRE CVE
cve.org · CVE-2026-3543
NVD
nvd.nist.gov/vuln/detail/CVE-2026-3543
MITRE CWE · CWE-787
cwe.mitre.org
Vendor Advisory
chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop.html
Issue Tracking
issues.chromium.org/issues/485267831