CVE-2026-3545

CVE Enrichment

CVSS: 9.6 CRITICAL
EPSS: 0.40%
EPSS Percentile: 33.59%
CISA KEV: Not listed

Description

Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 05-Mar-2026 03:16
Last Modified: 17-Jun-2026 17:43
EPSS Date: 2026-10-25
CWE: CWE-20

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:C /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

google / chrome Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 145.0.7632.159
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
google / chrome Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 145.0.7632.160
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

References

Last enrichment sync: 26-Oct-2026 14:22
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

#Chrome Google Says Three Chrome Releases Fixed 1,442 Security Flaws
Tracked as CVE-2026-3545 (CVSS score of 9.8) and patched in early May in Chrome 145, the issue could have allowed “a compromised renderer to trick the browser into reading local files,” it says. Google Says AI Agent Helped Find 13-Year-Old Chrome Sandbox Escape

Vendors (1)

Products (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.