CVE-2026-3910

As of 2026-03-13, CVE-2026-3910 is a CVSS 8.8 (HIGH-severity) vulnerability. CISA KEV-listed (known exploited). EPSS exploitation probability 0.6%. Threadlinqs Intelligence tracks 2 threats exploiting it.

Last updated: 2026-03-13

Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-94, CWE-119

Exploitation status

CISA KEV-listed (known exploited)

Threats tracking this CVE

• Google Chrome Double Zero-Day — Skia OOB Write & V8 Implementation Flaw (CVE-2026-3909, CVE-2026-3910) — CRITICAL
• Chrome V8 and Skia Zero-Days Under Active Exploitation (CVE-2026-3910, CVE-2026-3909) — CRITICAL

References

• https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html
• https://issues.chromium.org/issues/491410818
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3910

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.