Chrome Zero-Day Vulnerabilities Actively Exploited in the Wild to Execute Malicious Code
Google has released a critical security update for its Chrome browser to address two high-severity zero-day vulnerabilities currently being exploited. The stable channel has been updated to version 146.0.7680.75/76 for Windows and macOS, and…
Google has released a critical security update for its Chrome browser to address two high-severity zero-day vulnerabilities currently being exploited. The stable channel has been updated to version 146.0.7680.75/76 for Windows and macOS, and 146.0.7680.75 for Linux. The update will be rolled out to users over the upcoming days and weeks.
Both vulnerabilities, reported internally by Google's security team on March 10, 2026, have been rated as high severity, highlighting the immediate risk to Chrome users globally.
CVE-2026-3909: Out-of-Bounds Write in Skia
The first vulnerability, CVE-2026-3909, is an out-of-bounds write issue within Skia, the open-source 2D graphics engine used by Chrome's rendering pipeline. Such vulnerabilities allow attackers to overwrite adjacent memory, which can potentially lead to arbitrary code execution or application crashes. Exploiting this flaw in a browser context can enable attackers to bypass sandbox protections and execute malicious code.
CVE-2026-3910: Inappropriate Implementation in V8
The second issue, CVE-2026-3910, involves an inappropriate implementation in V8, Chrome's JavaScript and WebAssembly engine. Flaws in V8 are often targeted by attackers due to the frequent execution of JavaScript during web browsing, providing numerous opportunities for exploitation. An attacker could design a malicious webpage to trigger this flaw, executing code within the browser process.
Google has released a critical security update for its Chrome browser to address two high-severity zero-day vulnerabilities currently being exploited.
Google has confirmed the existence of exploits for both CVE-2026-3909 and CVE-2026-3910, marking this update as critical for both individuals and organizations. Detailed technical information regarding these vulnerabilities remains restricted until a majority of users have applied the patch to prevent further exploitation.
To mitigate exposure, users and administrators should update Chrome immediately. To manually update:
Open Chrome and go to Menu → Help → About Google Chrome. Chrome will automatically check for and apply the latest update. Restart the browser to complete the installation.
Organizations using enterprise policies for Chrome deployments should prioritize the update to version 146.0.7680.75/76 across their environments. Due to the active exploitation of these vulnerabilities, waiting for the automatic rollout is not advisable for high-risk environments.
Based on reporting by Cyber Security News.
