Chrome V8 and Skia Zero-Days Under Active Exploitation (CVE-2026-3910, CVE-2026-3909)
Chrome V8 and Skia Zero-Days Under Active Exploitation (TL-2026-0222), also tracked as Chromium Issue #491410818, is a critical-severity zero-day vulnerability scored CVSS 8.8, first published 2026-03-13. It has no confirmed attribution, affects Google Chrome, references 2 CVEs (CVE-2026-3910, CVE-2026-3909), maps to 14 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 13 indicators of compromise.
Key facts for TL-2026-0222
- Threat ID
- TL-2026-0222
- Also known as
- Chromium Issue #491410818, Chromium Issue #491421267
- Severity
- CRITICAL
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- ZERO_DAY
- First published
- 2026-03-13
- Last reviewed
- 2026-03-13
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, financial, technology, defense, healthcare, education, media, telecommunications, energy, critical-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
Google released an emergency out-of-band Chrome 146 update on March 12, 2026 to patch two zero-day vulnerabilities actively exploited in the wild. CVE-2026-3910 is an inappropriate implementation flaw in Chrome's V8 JavaScript engine enabling arbitrary code execution via crafted HTML pages. CVE-2026-3909 is an out-of-bounds write in the Skia graphics library allowing memory corruption and potential code execution. Both were discovered by Google internally and represent the second and third Chrome zero-days of 2026.
How Chrome V8 and Skia Zero-Days Under Active Exploitation works
On March 12, 2026, Google issued an emergency security update for Chrome 146 to address two actively exploited zero-day vulnerabilities: CVE-2026-3910 and CVE-2026-3909. Both flaws were discovered by Google's internal security team and had confirmed in-the-wild exploitation at the time of patch release.
**CVE-2026-3910 — Inappropriate Implementation in V8 (CVSS 8.8)**
CVE-2026-3910 is an inappropriate implementation vulnerability in Chrome's V8 JavaScript and WebAssembly engine. The flaw allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a victim to a specially crafted HTML page. V8 vulnerabilities are particularly dangerous because JavaScript is constantly executed during normal web browsing, creating abundant exploitation opportunities. The vulnerability was tracked as Chromium Issue #491410818. Google has withheld technical details pending widespread patch adoption, but the flaw's nature — inappropriate implementation in the JIT compilation or optimization pipeline — suggests attackers found a way to abuse V8's internal logic to achieve type confusion or similar memory safety violations leading to code execution.
**CVE-2026-3909 — Out-of-Bounds Write in Skia (CVSS 8.8)**
CVE-2026-3909 is an out-of-bounds write vulnerability (CWE-787) in Skia, the open-source 2D graphics library used by Chrome for rendering web content and UI elements. The flaw allows a remote attacker to perform out-of-bounds memory access via a crafted HTML page, potentially leading to application crashes or arbitrary code execution. Skia OOB write bugs can be leveraged to overwrite adjacent memory regions, and in a browser context, can potentially be chained with other vulnerabilities to escape sandbox protections. The vulnerability was tracked as Chromium Issue #491421267.
**Combined Exploitation Potential**
While Google has not disclosed whether the two vulnerabilities were exploited together in a chain, the combination of a V8 code execution flaw and a Skia memory corruption bug represents a potent attack surface. V8 exploits typically achieve code execution within the renderer sandbox, while Skia OOB writes could potentially be leveraged for sandbox escape or to corrupt renderer process state. In real-world exploitation campaigns targeting Chrome, attackers typically chain renderer exploits with sandbox escape bugs to achieve full system compromise.
**Affected Software and Patch Information**
All Chrome versions prior to 146.0.7680.75 are affected. The emergency update was released two days after the initial Chrome 146 stable channel launch on March 10, 2026. Patched versions are 146.0.7680.75/76 for Windows, 146.0.7680.76 for macOS, and 146.0.7680.75 for Linux. All Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi are also affected and should apply corresponding patches.
**2026 Chrome Zero-Day Context**
These represent the second and third actively exploited Chrome zero-days in 2026, following CVE-2026-2441 (use-after-free in CSS handling, CVSS 8.8) which was patched in February 2026. The pace of Chrome zero-day exploitation continues to accelerate, with three confirmed in-the-wild exploits in the first three months of 2026.
MITRE ATT&CK techniques used in TL-2026-0222
collection
defense-evasion
T1027 Obfuscated Files or Information; T1211 Exploitation for Stealth
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
privilege-escalation
T1068 Exploitation for Privilege Escalation
command-and-control
T1071 Application Layer Protocol
discovery
T1082 System Information Discovery
initial-access
impact
T1499 Endpoint Denial of Service
credential-access
T1539 Steal Web Session Cookie
resource-development
reconnaissance
Affected products and versions in Chrome V8 and Skia Zero-Days Under Active Exploitation
- Google — Chrome
Vulnerable versions: All versions prior to 146.0.7680.75
Fixed in: 146.0.7680.75 (Windows/Linux); 146.0.7680.76 (macOS) - Google — Chromium
Vulnerable versions: All versions prior to 146.0.7680.75
Fixed in: 146.0.7680.75 - Microsoft — Edge (Chromium-based)
Vulnerable versions: Versions using Chromium < 146.0.7680.75
Fixed in: Pending vendor update - Brave Software — Brave Browser
Vulnerable versions: Versions using Chromium < 146.0.7680.75
Fixed in: Pending vendor update - Opera Software — Opera Browser
Vulnerable versions: Versions using Chromium < 146.0.7680.75
Fixed in: Pending vendor update - Vivaldi Technologies — Vivaldi Browser
Vulnerable versions: Versions using Chromium < 146.0.7680.75
Fixed in: Pending vendor update
Remediation for Chrome V8 and Skia Zero-Days Under Active Exploitation
Patches
- Chrome 146.0.7680.75 (Windows/Linux)
- Chrome 146.0.7680.76 (macOS)
- Chromium-based browser updates pending from Microsoft Edge, Brave, Opera, and Vivaldi
Immediate actions
- Update Google Chrome to version 146.0.7680.75 or later immediately
- Force Chrome updates via enterprise policy (ChromeManagementEnabled + UpdateDefault)
- Verify patch deployment across all endpoints via chrome://version
- Monitor for exploitation indicators in browser crash reports and renderer process anomalies
- Block known malicious URLs serving exploit content at web proxy/firewall level
Workarounds
- Use an alternative non-Chromium browser (Firefox, Safari) until patch is applied
- Disable JavaScript execution for untrusted sites via Chrome settings or extensions
- Enable Site Isolation (chrome://flags/#enable-site-per-process) if not already active
- Restrict access to untrusted websites via web filtering policies
Longer-term hardening
- Deploy browser isolation solutions to contain renderer exploits
- Implement Content Security Policy headers on all web properties to reduce attack surface
- Enable Chrome's Enhanced Safe Browsing for real-time phishing and exploit protection
- Establish automated patch deployment pipeline for browser updates within 24-48 hours of release
- Deploy EDR solutions with browser exploitation detection capabilities
- Consider application whitelisting to prevent post-exploitation payload execution
CVEs associated with Chrome V8 and Skia Zero-Days Under Active Exploitation
Weaknesses (CWE) in Chrome V8 and Skia Zero-Days Under Active Exploitation
CWE-787, CWE-358
Timeline of Chrome V8 and Skia Zero-Days Under Active Exploitation
- CVE-2026-2441 (Chrome CSS use-after-free zero-day) patched in February 2026, marking the first Chrome zero-day of the year
- CVE-2026-3910 (V8 inappropriate implementation) and CVE-2026-3909 (Skia OOB write) discovered by Google internal security team and reported
- Chrome 146 stable channel released with versions 146.0.7680.71/72 for Windows/Mac and 146.0.7680.71 for Linux, containing 29 security fixes
- CVE IDs CVE-2026-3910 and CVE-2026-3909 reserved by Chrome security team
- CVE-2026-3910 and CVE-2026-3909 officially published with Google confirming active exploitation in the wild for both vulnerabilities
- Emergency out-of-band Chrome 146 update released: 146.0.7680.75/76 for Windows/Mac, 146.0.7680.75 for Linux, fixing both zero-days
- Security community responds with advisories from SOC Prime, Malwarebytes, The Hacker News, SecurityWeek, and other outlets urging immediate patching
- As of 2026-05-29, both Chrome zero-days (CVE-2026-3910 V8, CVE-2026-3909 Skia) remain fully patched in Chrome 146.0.7680.75+ since March 12-13, 2026, and the CISA KEV remediation deadline (March 27) is ~2 months past with auto-update driving near-universal adoption. Exploitation required unpatched builds, attribution stays unattributed with no tracked campaign, and newer Chrome zero-days are distinct flaws, not successors.
Sources cited for Chrome V8 and Skia Zero-Days Under Active Exploitation
- Chrome Releases: Stable Channel Update for Desktop (March 10, 2026)
- SOC Prime: CVE-2026-3910 Chrome V8 Zero-Day Used for In-the-Wild Attacks
- Malwarebytes: Google patches two Chrome zero-days under active attack
- The Hacker News: Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8
- The Register: Google rushes Chrome update to fix zero-days under attack
- SecurityWeek: Chrome 146 Update Patches Two Exploited Zero-Days
- PCWorld: Emergency Chrome 146 update patches 2 zero-day vulnerabilities
- GBHackers: Two Newly Discovered Chrome Zero-Days Exploited in the Wild
- CybersecurityNews: Chrome Zero-Day Vulnerabilities Actively Exploited in the Wild
- THREATINT CVE Database: CVE-2026-3910
- THREATINT CVE Database: CVE-2026-3909
- Chromium Issue Tracker: Bug #491410818 (CVE-2026-3910)
- Chromium Issue Tracker: Bug #491421267 (CVE-2026-3909)
Threats related to Chrome V8 and Skia Zero-Days Under Active Exploitation
Detection coverage for TL-2026-0222
As of 2026-03-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0222 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.