U.S. CISA adds Google Chrome flaws to its Known Exploited Vulnerabilities catalog

CVE-2026-3909 is an out-of-bounds write (CWE-787) in the Skia graphics rendering library used by Google Chrome, which Google patched in Chrome 146.0.7680.75. A remote attacker can trigger the flaw by luring a user to visit a crafted HTML page, causing out-of-bounds memory access in the browser process; the High CVSS 8.8 score with high confidentiality, integrity, and availability impact indicates memory corruption with potentially serious consequences. All Google Chrome installations running versions prior to 146.0.7680.75 are affected, and because the vulnerability resides in the Skia engine, the vulnerable code is present in every Chrome install. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-03-13, indicating exploitation in the wild, though no public proof-of-concept is known and ransomware use is unknown. EPSS currently assigns a 1.6% probability of exploitation within the next 30 days (75th percentile).

Do: Update Google Chrome to version 146.0.7680.75 or later on all endpoints, prioritizing systems with privileged or high-risk users; confirm the updated version is deployed rather than relying on auto-update timing. As an interim mitigation, restrict web browsing on sensitive systems and warn users about visiting untrusted pages; federal agencies must apply the fix per BOD 22-01 requirements given the KEV listing.

CVE-2026-3910 is an out-of-bounds memory flaw — CISA classifies it as improper restriction of operations within the bounds of a memory buffer — caused by an inappropriate implementation in the V8 JavaScript and WebAssembly engine used in Google Chrome. A remote attacker triggers it by luring a user to a crafted HTML page, so exploitation requires user interaction but no privileges or special conditions. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome sandbox, which confines the compromise to the renderer process rather than the full system, but still exposes data and credentials handled within the browser session. Anyone running Google Chrome prior to 146.0.7680.75 — or a Chromium-based browser that embeds the vulnerable V8 code — is affected. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-13, and it comes amid a string of actively exploited Chrome V8 zero-days that Google has fixed during 2026.

Do: Update Google Chrome to version 146.0.7680.75 or later immediately, and verify fleet versions rather than assuming auto-update has completed. Users of Chromium-derived browsers should install their vendor's update that incorporates the corresponding V8 fix. Federal organizations must follow the BOD 22-01 required action in the KEV catalog — apply vendor mitigations or discontinue use of affected versions if mitigations are unavailable.