Cyber Posture

CVE-2026-3922

High

Published: 11 March 2026

Published
11 March 2026
Modified
13 March 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0013 31.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Use after free in MediaStream in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires timely remediation of the use-after-free vulnerability in Chrome's MediaStream by applying the patch to version 146.0.7680.71 or later.

prevent

Implements memory protections such as ASLR and DEP to prevent exploitation of heap corruption from the use-after-free in MediaStream.

prevent

Provides process isolation in browsers like Chrome to contain the impact of MediaStream exploitation within sandboxed renderer processes.

Security SummaryAI

CVE-2026-3922 is a use-after-free vulnerability (CWE-416) in the MediaStream component of Google Chrome prior to version 146.0.7680.71. Published on 2026-03-11, it enables a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium rates its security severity as High, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A remote attacker can exploit this vulnerability over the network with low attack complexity and no privileges required, though user interaction is needed, such as clicking or visiting a malicious site. Successful exploitation could lead to high impacts on confidentiality, integrity, and availability through heap corruption.

Mitigation is available via the stable channel update for Chrome desktop to version 146.0.7680.71 or later, as announced in the Chrome Releases blog. Additional details are documented in the Chromium issue tracker.

Details

CWE(s)

Affected Products

google
chrome
≤ 146.0.7680.71

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Use-after-free vulnerability in Chrome's MediaStream exploited via crafted HTML page for heap corruption and remote code execution, directly enabling Exploitation for Client Execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References