Chrome zero-days CVE-2026-3909, CVE-2026-3910 exploited in wild
Google patched two actively exploited zero-day vulnerabilities in Chrome—an out-of-bounds write in Skia and an implementation flaw in V8—enabling arbitrary code execution.
Google has released security updates for Chrome addressing multiple vulnerabilities, including two zero-day flaws actively exploited in the wild. CVE-2026-3909 is an out-of-bounds write vulnerability in Skia, and CVE-2026-3910 involves an inappropriate implementation in V8. Both vulnerabilities can enable arbitrary code execution through drive-by compromise attacks, allowing attackers to execute malicious code in the context of the logged-on user.
Successful exploitation could permit attackers to install programs, modify or delete data, or create new accounts with full user rights. The impact varies based on the victim's privilege level, with administrative users facing greater risk than those operating with limited permissions. The MS-ISAC has assigned high risk ratings across government, business, and home user environments.
Affected versions include Chrome prior to 146.0.7680.75/76 for Windows and macOS, and prior to 146.0.7680.75 for Linux. Organizations are urged to apply the updates immediately after testing, implement automated patch management, enforce least-privilege principles, and deploy anti-exploitation features and web-filtering controls to mitigate risk.
Mentioned in this report
Detection guidance
Chrome Browser Spawning Suspicious Child Process (Possible Exploitation)
Detects Chrome (or its renderer/GPU helper processes) spawning command interpreters, scripting engines, or LOLBins, which is a common post-exploitation indicator following successful drive-by browser exploitation such as CVE-2026-3909/CVE-2026-3910. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Browser Spawning Suspicious Child Process
id: fad8db80-2507-5cdb-85c5-b1ab03de3a2d
status: experimental
description: 'Detects chrome.exe (including renderer/GPU-process children) launching
command
interpreters, scripting hosts, or common living-off-the-land binaries. This
behaviour is consistent with successful exploitation of a browser memory-
corruption vulnerability (e.g. Skia out-of-bounds write, V8 type confusion)
leading to arbitrary code execution in the context of the logged-on user,
as described for CVE-2026-3909 and CVE-2026-3910.
'
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-3909
- https://nvd.nist.gov/vuln/detail/CVE-2026-3910
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \chrome.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \bitsadmin.exe
- \certutil.exe
- \msiexec.exe
filter_updater:
CommandLine|contains:
- GoogleUpdate
- \Google\Update\
- --type=crashpad-handler
condition: selection_parent and selection_child and not filter_updater
falsepositives:
- Chrome component updater or crash-reporting processes launching helper binaries
- Enterprise software deployment tools that interact with Chrome via automation and
spawn helper processes
- Legitimate use of Chrome's native messaging host that briefly spawns rundll32/msiexec
for extension installation
level: medium
tags:
- attack.t1189
- attack.execution
author: Vorant
Office/Script Interpreter Spawned by Chrome Renderer or GPU Process Writing New Executable
Detects a newly created executable or script file dropped to disk shortly after a Chrome renderer/GPU child process runs, indicative of a drive-by exploit payload write following successful browser code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Write by Chrome Child Process to User-Writable Directory
id: 9d309a5e-2aa4-5e23-9bbc-65de21c220db
status: experimental
description: 'Detects executable or script files being written by a process whose
parent
is chrome.exe, into commonly abused user-writable locations (Temp, AppData,
Downloads, Public). This can indicate payload delivery following successful
exploitation of a Chrome memory-corruption vulnerability such as
CVE-2026-3909 or CVE-2026-3910, where the renderer/GPU process gains the
ability to write and later execute arbitrary code in the user context.
'
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-3909
- https://nvd.nist.gov/vuln/detail/CVE-2026-3910
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \chrome.exe
TargetFilename|endswith:
- .exe
- .dll
- .ps1
- .hta
- .js
- .vbs
path_filter:
TargetFilename|contains:
- \AppData\Local\Temp\
- \AppData\Roaming\
- \Downloads\
- \Users\Public\
legit_filter:
TargetFilename|contains:
- \Google\Chrome\Application\
- \Google\Update\
condition: selection and path_filter and not legit_filter
falsepositives:
- Chrome extension or component update writing legitimate DLL/EXE payloads into its
own application folder
- User-initiated download of a script or installer via Chrome that is saved to the
Downloads folder
level: medium
tags:
- attack.t1189
- attack.defense-evasion
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-023
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free