High

Object lifecycle issue in Chrome DevTools

IdentifiersCVE-2026-3539CWE-416

CVE-2026-3539 is a high-severity object lifecycle issue in DevTools in Google Chrome affecting versions prior to 145.0.7632.159. The available advisory states that the flaw could allow heap corruption when a user is convinced to install and use a crafted malicious Chrome extension. Based on the vendor wording ('object lifecycle issue' leading to heap corruption), the vulnerability is consistent with a memory-safety flaw involving improper handling of object lifetime in the DevTools component, such as use-after-free or related stale-object access conditions. Google has restricted detailed technical information pending broad patch adoption, so specific vulnerable functions or code paths are not currently available.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation could result in heap corruption within the Chrome browser process associated with DevTools handling. In practical terms, memory corruption vulnerabilities of this class can enable browser compromise, including potential arbitrary code execution, process crash/denial of service, or other unintended behavior, subject to exploit reliability and the surrounding sandbox and extension execution context. The provided sources do not state confirmed in-the-wild exploitation, and Google indicated it had not disclosed evidence of active exploitation at the time of the advisory.

Mitigation

If you can’t patch tonight, do this now.

Until patching is complete, reduce exposure by preventing or tightly controlling installation of untrusted Chrome extensions, especially in enterprise environments. Enforce extension allowlisting where possible, restrict user ability to install arbitrary extensions, and monitor for unauthorized extension deployment. Because exploitation requires a malicious crafted extension and user installation, minimizing extension attack surface materially reduces risk prior to full remediation.

Remediation

Patch, then assume compromise.

Update Google Chrome to version 145.0.7632.159 or later (145.0.7632.159/160 on Windows and macOS, 145.0.7632.159 on Linux) to obtain the vendor fix. Enterprise administrators should deploy the updated Chrome version across managed endpoints using standard enterprise policy and software distribution mechanisms.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GoogleChromeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

11 SOURCESView more in app

cyber security newsNews

Mar 5, 2026

Google Releases Emergency Chrome Update to Fix 10 Security Vulnerabilities

High-severity object lifecycle issue in Google Chrome DevTools.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity8

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-3539

NVD

nvd.nist.gov/vuln/detail/CVE-2026-3539

MITRE CWE · CWE-416

cwe.mitre.org

Vendor Advisory

chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop.html

Issue Tracking

issues.chromium.org/issues/483853098