CVE-2026-3923
Published: 11 March 2026
Description
Use after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the use-after-free flaw in Chrome's WebMIDI via software updates to version 146.0.7680.71 or later.
Implements memory protections like ASLR and DEP to prevent exploitation of heap corruption from use-after-free in the renderer process.
Provides process isolation through browser sandboxing to contain potential arbitrary code execution in the compromised WebMIDI renderer process.
Security SummaryAI
CVE-2026-3923 is a use-after-free vulnerability (CWE-416) in the WebMIDI component of Google Chrome prior to version 146.0.7680.71. Published on 2026-03-11, it enables potential heap corruption via a crafted HTML page, as reported with High severity by the Chromium security team. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker can exploit this vulnerability without requiring user privileges by luring victims to interact with a malicious HTML page. Successful exploitation could lead to heap corruption, granting high impacts on confidentiality, integrity, and availability, such as potential arbitrary code execution within the browser's renderer process.
Mitigation is available through the Google Chrome stable channel update to version 146.0.7680.71 or later, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_10.html. Additional technical details are provided in the Chromium issue tracker at https://issues.chromium.org/issues/485935314. Security practitioners should prioritize updating affected Chrome installations.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free vulnerability in Chrome's WebMIDI component exploited via crafted HTML page requiring user interaction, enabling arbitrary code execution in the renderer process, directly mapping to Exploitation for Client Execution (T1203).