Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 4 products
| Date | Total | Labels |
|---|
| 2026-03-04 | 2 | Disclosure2 |
| 2026-03-05 | 2 | Disclosure2 |
| 2026-03-08 | 1 | Disclosure1 |
| 2026-03-10 | 1 | Patch1 |
| 2026-06-12 | 1 | General1 |
I wrote a short article about my research on Chromium, it's not too technical, but still relevant. I hope you guys like it. I plan to release the technical article in a few weeks (or days). https://davi-1337.github.io/posts/out-of-tune-cve-2026-3540.html
Post summary
The author announces a forthcoming technical article on CVE-2026-3540, without providing specific PoC, exploit, or mitigation information.
İşte güncel ve yamasız kritik güvenlik zafiyetlerinin CVE listesi, önem derecesine göre sıralanmış şekilde: ## Kritik Zafiyetler (CVSS 10.0 - En Yüksek Risk) - **Cisco Secure Firewall ürünleri**: Mart 2026 güncellemesinde 48 güvenlik açığı giderildi, bunlardan 2 tanesi CVSS 10.0 seviyesinde kritik açıklardır. Bu açıklar saldırganlara sistem kontrolü vermektedir.^4^ ## Sıfır Gün Açıkları (Aktif İstismar Riski) - **CVE-2026-21385**: Android için - sınırlı ve hedefli istismar edildiğine dair işaretler bulunan sıfır gün açığı^1^ - **CVE-2026-21510**: Windows Shell güvenlik özelliği atlama açığı^3^ - **CVE-2026-21513**: MSHTML Framework güvenlik özelliği atlama açığı^3^ - **CVE-2026-21514**: Microsoft Word güvenlik özelliği atlama açığı^3^ - **CVE-2026-21519**: Desktop Window Manager yetki yükseltme açığı^3^ - **CVE-2026-21533**: Remote Desktop Services yetki yükseltme açığı^3^ - **CVE-2026-21525**: Remote Access Connection Manager hizmet aksatma açığı^3^ ## Google Chrome Kritik Açıkları - **CVE-2026-3536**: ANGLE'da tamsayı taşması (Kritik)^10^ - **CVE-2026-3537**: PowerVR'da nesne yaşam döngüsü sorunu (Kritik)^10^ - **CVE-2026-3538**: Skia'da tamsayı taşması (Kritik)^10^ ## Yüksek Önemli Açıklar - **CVE-2026-3539**: DevTools'da nesne yaşam döngüsü sorunu (Yüksek)^10^ - **CVE-2026-3540**: WebAudio'da uygunsuz implementasyon (Yüksek)^10^ - **CVE-2026-3541**: CSS'de uygunsuz implementasyon (Yüksek)^10^ - **CVE-2026-3542**: WebAssembly'de uygunsuz implementasyon (Yüksek)^10^ - **CVE-2026-3543**: V8'de uygunsuz implementasyon (Yüksek)^10^ - **CVE-2026-3544**: WebCodecs'da heap buffer overflow (Yüksek)^10^ - **CVE-2026-3545**: Navigasyonda yetersiz veri doğrulama (Yüksek)^10^ ## Güncelleme Önerileri - **Windows 11**: KB5077181 (25H2/24H2) ve KB5075941 (23H2) güncellemeleri ile 6 sıfır gün açığı kapatıldı^3^ - **Android**: 2026-03-05 güvenlik yama seviyesi veya üzeri tüm açıkları giderir^1,2^ - **Google Chrome**: En son sürüme güncelleme yapılması kritik açıklar için zorunludur^1^ - **Cisco ürünleri**: Mart 2026 paket güvenlik güncellemesinin uygulanması gerekir^4^ Bu zafiyetler arasında özellikle sıfır gün açıkları ve CVSS 10.0 seviyesindeki açıklar en yüksek riski taşımaktadır ve acil olarak yamanması gerekmektedir.
Post summary
The post lists several high‑risk CVEs, notes active exploitation concerns, and provides explicit patch updates and remediation guidance, urging immediate action.
・CVE-2026-3540：Inappropriate implementation in WebAudio（High） ・CVE-2026-3541：Inappropriate implementation in CSS（High） ・CVE-2026-3542：Inappropriate implementation in WebAssembly（High） ・CVE-2026-3543：Inappropriate implementation in V8（High）
Post summary
The text announces four high‑severity CVEs involving inappropriate implementations in key web technologies, without detailing exploits or mitigation.
🟠 CVE-2026-3540 - High Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security s... https://www.thehackerwire.com/vulnerability/CVE-2026-3540/ https://t.co/xYfs7YAc7Z
Post summary
The tweet announces CVE-2026-3540, a high‑severity out‑of‑bounds memory access flaw in Chrome WebAudio that can be triggered by a crafted HTML page; no PoC, exploit, or patch is referenced.
CVE-2026-3540 Out-of-Bounds Memory Access in Google Chrome WebAudio Prio... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3540 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The text announces CVE‑2026‑3540, an Out‑of‑Bounds Memory Access vulnerability in Google Chrome’s WebAudio component, and directs readers to a vulnerability details page.
🚨*CVE* CVE-2026-3540 Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML pa… https://www.cve.org/CVERecord?id=CVE-2026-3540 ----- Traducción: CVE-2026-3540 Imp… http://infoflow.cloud`
Post summary
The text offers a brief disclosure of CVE-2026-3540, describing an out-of-bounds memory access flaw in Chrome's WebAudio before version 145.0.7632.159, but contains no information about exploitation, patches, or PoC.
CVE-2026-3540 Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML pa… https://www.cve.org/CVERecord?id=CVE-2026-3540
Post summary
The post announces CVE-2026-3540, describing a memory corruption flaw in Chrome's WebAudio that allows remote out‑of‑bounds memory access via a crafted HTML element.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | apple | macos | - | - | - |
| App | chrome | - | - | - | |
| OS | linux | linux_kernel | - | - | - |
| OS | microsoft | windows | - | - | - |