Chrome zero-days CVE-2026-3909, -3910 exploited
Google Chrome has two actively exploited zero-day vulnerabilities that could let attackers achieve arbitrary code execution.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-3909 and CVE-2026-3910 as exploited in the wild.
CISecurity/MS-ISAC issued an advisory covering two vulnerabilities in Google Chrome, CVE-2026-3909 (an out-of-bounds write in Skia) and CVE-2026-3910 (an inappropriate implementation in V8), both of which Google has confirmed are being exploited in the wild. Successful exploitation could allow an attacker to execute arbitrary code in the context of the logged-in user, potentially leading to full system compromise depending on the user's privilege level.
The affected versions are Chrome prior to 146.0.7680.75/76 on Windows and macOS, and prior to 146.0.7680.75 on Linux. The advisory frames the likely attack vector as drive-by compromise, where a victim need only visit a malicious or compromised webpage to trigger exploitation. Given the presence of in-the-wild exploits for both flaws, organizations and home users should prioritize patching.
Recommended mitigations include immediate patching via vendor updates, enforcing least-privilege configurations, enabling anti-exploitation features (DEP, Exploit Guard, SIP/Gatekeeper), restricting web-based content via DNS/URL filtering, and general user security awareness training to reduce exposure to malicious links and drive-by download vectors.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-023
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,577 reports from 147 sources, 727 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs