CVE-2026-3061 is an out of bounds read in the Media component of Google Chrome (CVSS 9.1 in NVD, rated High by Chromium) before version 145.0.7632.116. A crafted HTML page could trigger the memory read. Update to 145.0.7632.116 or later and restart the browser.
What's affected
Google Chrome before 145.0.7632.116 is affected, on Windows, macOS and Linux. The Chrome Releases post from 23 February 2026 says the Stable channel moved to 145.0.7632.116 or 145.0.7632.117 for Windows and Mac and 145.0.7632.116 for Linux, rolling out over days to weeks. That update carried three security fixes.
The NVD record names Chrome on Windows, macOS and Linux. Other Chromium based browsers are not listed there, so check each vendor's release notes for when they picked up the fix.
How to check if you're exposed
In Chrome, open the address bar and go to chrome://version. Compare the version with 145.0.7632.116. If it is lower, open the three dot menu, choose Help and then About Google Chrome to trigger an update, and restart the browser.
For fleets, ask your endpoint management tool for the installed Chrome version per device, or on Linux check the package:
google-chrome --version
Browsers built on Chromium, and apps that embed it, need their own updates.
What to do now
- Update Chrome to 145.0.7632.116 or later on every device, and restart the browser, since the fix applies only after a relaunch.
- Use your device management tool to enforce automatic updates and to report browsers that lag behind.
- Check other Chromium based browsers and embedded runtimes you use, and apply their vendors' updates.
- Keep a short list of the browsers in use across your company so a Chrome advisory reaches everyone who needs it.
- Review the Chrome Releases post for the two other security fixes in the same build.
Why it matters
The record files this under CWE-125, out of bounds read. The code reads memory past the end of a buffer it was meant to stay inside, which can expose data from the browser process. The CVSS vector rates confidentiality and availability impact as high and requires a user to load a crafted page, which in a browser is a low bar.
Browsers are exposed to untrusted content all day, so patches here deserve a fast rollout, and the practical risk is the gap between release and restart. The record does not mark this as exploited in the wild, and it is not in the CISA KEV catalog. The Chrome release post says bug details may stay restricted until most users have updated.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to restart Chrome?
Yes. The update applies only after the browser relaunches.
Is this exploited in the wild?
The record does not say so and it is not marked in CISA KEV.
Sources
Last reviewed: 19 October 2026.
