CVE-2026-3910

CVE-2026-3910 is an out-of-bounds memory flaw — CISA classifies it as improper restriction of operations within the bounds of a memory buffer — caused by an inappropriate implementation in the V8 JavaScript and WebAssembly engine used in Google Chrome. A remote attacker triggers it by luring a user to a crafted HTML page, so exploitation requires user interaction but no privileges or special conditions. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome sandbox, which confines the compromise to the renderer process rather than the full system, but still exposes data and credentials handled within the browser session. Anyone running Google Chrome prior to 146.0.7680.75 — or a Chromium-based browser that embeds the vulnerable V8 code — is affected. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-13, and it comes amid a string of actively exploited Chrome V8 zero-days that Google has fixed during 2026.

What to do: Update Google Chrome to version 146.0.7680.75 or later immediately, and verify fleet versions rather than assuming auto-update has completed. Users of Chromium-derived browsers should install their vendor's update that incorporates the corresponding V8 fix. Federal organizations must follow the BOD 22-01 required action in the KEV catalog — apply vendor mitigations or discontinue use of affected versions if mitigations are unavailable.