Google Chrome Double Zero-Day — Skia OOB Write & V8 Implementation Flaw (CVE-2026-3909, CVE-2026-3910)
Google Chrome Double Zero-Day (TL-2026-0230), also tracked as Chrome Double Zero-Day March 2026, is a critical-severity zero-day vulnerability scored CVSS 8.8, first published 2026-03-15. It has no confirmed attribution, affects Google Chrome, references 2 CVEs (CVE-2026-3909, CVE-2026-3910), maps to 20 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-0230
- Threat ID
- TL-2026-0230
- Also known as
- Chrome Double Zero-Day March 2026, Skia OOB Write, V8 Sandbox Code Execution
- Severity
- CRITICAL
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- ZERO_DAY
- First published
- 2026-03-15
- Last reviewed
- 2026-03-15
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, technology, financial, defense, healthcare, energy, telecommunications, education, media
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 15
Two actively exploited zero-day vulnerabilities in Google Chrome — CVE-2026-3909 (out-of-bounds write in Skia graphics library, CVSS 8.8) and CVE-2026-3910 (inappropriate implementation in V8 JavaScript engine, CVSS 8.8) — were added to CISA KEV on March 13, 2026. Both allow remote code execution via crafted HTML pages and affect all Chromium-based browsers. Google TAG discovered and reported both flaws on March 10, 2026 with active exploitation confirmed in the wild.
How Google Chrome Double Zero-Day works
On March 12, 2026, Google released an emergency stable channel update for Chrome (146.0.7680.75/76 for Windows/macOS, 146.0.7680.75 for Linux) addressing two high-severity zero-day vulnerabilities that were actively exploited in the wild. Both were discovered internally by Google's Threat Analysis Group (TAG) on March 10, 2026, with patches shipped within two days.
CVE-2026-3909 is an out-of-bounds write vulnerability (CWE-787) in the Skia 2D graphics library, which serves as the core rendering engine for Google Chrome, ChromeOS, Android, and Flutter. The flaw allows a remote attacker to perform out-of-bounds memory access via a specially crafted HTML page. Memory corruption in Skia can lead to arbitrary code execution in the renderer process context. When chained with other bugs, an out-of-bounds write in Skia can potentially enable sandbox escape from the renderer process. Skia processes all visual content rendered in the browser — fonts, vector graphics, images, and UI elements — making it a high-value target for attackers.
CVE-2026-3910 is an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine. Classified under CWE-94 (Code Injection) and CWE-119 (Improper Restriction of Operations within Memory Buffer Bounds), this flaw enables a remote attacker to execute arbitrary code inside the V8 sandbox via a crafted HTML page. V8 vulnerabilities are particularly dangerous because they can be triggered simply by directing victims to malicious or compromised websites — no file download or user interaction beyond navigation is required. Two public proof-of-concept exploits have been reported on GitHub (Chromium issue 491410818).
Both vulnerabilities share an identical CVSS 3.1 score of 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — indicating network-accessible, low-complexity attacks requiring only user interaction (visiting a malicious page) with high impact to confidentiality, integrity, and availability.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on March 13, 2026, establishing a federal remediation deadline of March 27, 2026 under Binding Operational Directive 22-01. This marks the third actively exploited Chrome zero-day of 2026, following CVE-2026-2441 (use-after-free in CSS handling) patched in February.
The attack surface extends beyond Chrome to all Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi. Exploitation delivery vectors observed in similar browser zero-day campaigns include spear-phishing links, watering hole compromises of legitimate websites, malvertising through ad networks, and compromised developer tooling or forums. Google has deliberately withheld exploitation details and threat actor attribution to prevent additional weaponization while users update.
The combined impact of these two vulnerabilities is severe: CVE-2026-3909 provides memory corruption capability in the graphics pipeline, while CVE-2026-3910 enables code execution in the JavaScript engine. If chained together, an attacker could potentially achieve full renderer compromise and, combined with a sandbox escape, gain arbitrary code execution on the host system.
MITRE ATT&CK techniques used in TL-2026-0230
collection
T1005 Data from Local System; T1056 Input Capture
defense-evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1211 Exploitation for Stealth; T1497 Virtualization/Sandbox Evasion
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution
privilege-escalation
T1068 Exploitation for Privilege Escalation
command-and-control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
discovery
T1082 System Information Discovery; T1518 Software Discovery
persistence
initial-access
T1189 Drive-by Compromise; T1566 Phishing
credential-access
T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Affected products and versions in Google Chrome Double Zero-Day
- Google — Chrome
Vulnerable versions: All versions prior to 146.0.7680.75
Fixed in: 146.0.7680.75 (Linux); 146.0.7680.75/76 (Windows/macOS) - Google — Chromium
Vulnerable versions: All versions prior to 146.0.7680.75
Fixed in: 146.0.7680.75 - Microsoft — Edge (Chromium-based)
Vulnerable versions: All Chromium-based versions prior to patched release
Fixed in: Latest Chromium-based update - Brave Software — Brave Browser
Vulnerable versions: All Chromium-based versions prior to patched release
Fixed in: Latest Chromium-based update - Opera Software — Opera
Vulnerable versions: All Chromium-based versions prior to patched release
Fixed in: Latest Chromium-based update - Vivaldi Technologies — Vivaldi
Vulnerable versions: All Chromium-based versions prior to patched release
Fixed in: Latest Chromium-based update - Google — ChromeOS
Vulnerable versions: Versions using Skia and V8 prior to patched release
Fixed in: Latest ChromeOS update
Remediation for Google Chrome Double Zero-Day
Patches
- Google Chrome 146.0.7680.75/76 (Windows/macOS)
- Google Chrome 146.0.7680.75 (Linux)
- Microsoft Edge — update to latest Chromium-based release
- Brave Browser — update to latest Chromium-based release
- Opera — update to latest Chromium-based release
- Vivaldi — update to latest Chromium-based release
Immediate actions
- Update Google Chrome to version 146.0.7680.75 or later immediately
- Force browser relaunch after update to activate patched build
- Update all Chromium-based browsers (Edge, Brave, Opera, Vivaldi) to latest versions
- Prioritize updates for high-value users: executives, finance, IT administrators
- Enable Chrome auto-update policies via Group Policy or MDM
- Block known malicious URLs at web proxy and DNS level
- Monitor EDR for unusual child process spawning from browser processes
Workarounds
- Restrict browsing to trusted sites only until patches are applied
- Use non-Chromium browser (Firefox, Safari) as temporary alternative
- Disable JavaScript execution for untrusted sites via browser settings
- Enable Enhanced Safe Browsing in Chrome settings
- Block access to newly registered domains at DNS level
Longer-term hardening
- Deploy browser isolation technology for high-risk browsing
- Implement network segmentation to limit lateral movement from compromised endpoints
- Deploy EDR with behavioral detection for memory corruption and sandbox escape patterns
- Enable Chrome Site Isolation feature across enterprise fleet
- Establish browser vulnerability patching SLA of 48 hours for CISA KEV entries
- Implement Content Security Policy headers on internal web applications
- Deploy DNS filtering to block newly registered and suspicious domains
CVEs associated with Google Chrome Double Zero-Day
Weaknesses (CWE) in Google Chrome Double Zero-Day
CWE-787, CWE-94, CWE-119
Timeline of Google Chrome Double Zero-Day
- Google confirms active exploitation of both vulnerabilities in the wild
- Google Threat Analysis Group (TAG) discovers and internally reports both CVE-2026-3909 (Skia OOB write) and CVE-2026-3910 (V8 inappropriate implementation)
- Google releases Chrome Stable Channel update 146.0.7680.75/76 (Windows/macOS) and 146.0.7680.75 (Linux) addressing the vulnerabilities
- Google updates Chrome release blog noting CVE-2026-3909 fix to be included in a future release, with CVE-2026-3910 confirmed patched in 146.0.7680.75
- Two public proof-of-concept exploits for CVE-2026-3910 reported available on GitHub
- Multiple security news outlets (The Hacker News, BleepingComputer, SecurityAffairs, SecurityWeek) publish detailed advisories and analysis
- CISA adds both CVE-2026-3909 and CVE-2026-3910 to Known Exploited Vulnerabilities (KEV) catalog with remediation deadline of March 27, 2026
- Threadlinqs Intelligence begins tracking as TL-2026-0230 with full research and D1 publication
- CISA KEV remediation deadline for federal agencies under Binding Operational Directive 22-01
- As of 2026-05-29, CVE-2026-3909 (Skia) and CVE-2026-3910 (V8) remain fully patched in Chrome 146.0.7680.75/76 (March 12), with the March 27 CISA KEV deadline long passed and no evidence of ongoing exploitation since the fix. Active exploitation was pre-patch only, the actor stays unattributed, and Chrome has moved to newer distinct zero-days (e.g. CVE-2026-5281), so this threat is remediated, not superseded.
Sources cited for Google Chrome Double Zero-Day
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- Chrome Stable Channel Update for Desktop (March 12, 2026)
- NVD — CVE-2026-3909
- NVD — CVE-2026-3910
- Chromium Issue Tracker — 491410818
- Google Fixes Two Chrome Zero-Days Exploited in the Wild — The Hacker News
- Google Fixes Two New Chrome Zero-Days Exploited in Attacks — BleepingComputer
- U.S. CISA Adds Google Chrome Flaws to KEV Catalog — SecurityAffairs
- Chrome 146 Update Patches Two Exploited Zero-Days — SecurityWeek
- CVE-2026-3910: Chrome V8 Zero-Day Used for In-the-Wild Attacks — SOC Prime
- Google Patches Two Chrome Zero-Days Under Active Attack — Malwarebytes
- Google Rushes Chrome Update to Fix Zero-Days Under Attack — The Register
- Chrome Zero-Day Vulnerabilities Actively Exploited — CybersecurityNews
- Two Newly Discovered Chrome Zero-Days Exploited in the Wild — GBHackers
- CVE-2026-3909 and CVE-2026-3910 Chrome Fixes — Purple Ops
Threats related to Google Chrome Double Zero-Day
Detection coverage for TL-2026-0230
As of 2026-03-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0230 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.