CVE-2026-3543 describes an inappropriate implementation in the V8 JavaScript engine within Google Chrome prior to version 145.0.7632.159, allowing a remote attacker to achieve out-of-bounds memory access via a crafted HTML page. This vulnerability impacts Google Chrome across various operating systems including Apple, Google, Linux, and Microsoft. Rated with a CVSS score of 8.8 (High), this vulnerability can be exploited remotely with low attack complexity, requiring user interaction (UI:R) to visit a malicious page. Successful exploitation could lead to high impacts on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation (KEV: No, Hot List: Inactive), and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. However, the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential interest.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 145.0.7632.159, < 145.0.7632.159CPE match | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
< 145.0.7632.159CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
< 145.0.7632.160CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.