CVE-2026-3062

The bug consists of improper memory handling (out of bounds read and out of bounds write — CWE-125 and CWE-787) in the Tint module responsible for graphics rendering in Chrome browser. An attacker delivers a specially crafted HTML page, whose processing by the vulnerable component causes access to memory areas exceeding the allocated buffer. This operation can be performed remotely, without user interaction beyond visiting the page itself, and requires no special privileges.

Successful exploitation of the vulnerability may allow an attacker to perform unauthorized read and write operations in the browser process memory, potentially leading to disclosure of sensitive data, data integrity violation, and arbitrary code execution (RCE) or application destabilization.

Google Chrome should be updated to version 145.0.7632.116 or newer, available through the browser's official update channel. Details in the manufacturer's references: https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_23.html

Google Chrome on macOS in versions earlier than 145.0.7632.116