# Google Chrome Double Zero-Day — Skia OOB Write & V8 Implementation Flaw (CVE-2026-3909, CVE-2026-3910)

> Two actively exploited zero-day vulnerabilities in Google Chrome — CVE-2026-3909 (out-of-bounds write in Skia graphics library, CVSS 8.8) and CVE-2026-3910 (inappropriate implementation in V8 JavaScript engine, CVSS 8.8) — were added to CISA KEV on March 13, 2026. Both allow remote code execution via crafted HTML pages and affect all Chromium-based browsers. Google TAG discovered and reported both flaws on March 10, 2026 with active exploitation confirmed in the wild.

- **Published:** 2026-03-15T12:00:00Z
- **Last reviewed:** 2026-03-15T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0230
- **ID:** TL-2026-0230
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** ZERO_DAY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-3909, CVE-2026-3910

## Description

On March 12, 2026, Google released an emergency stable channel update for Chrome (146.0.7680.75/76 for Windows/macOS, 146.0.7680.75 for Linux) addressing two high-severity zero-day vulnerabilities that were actively exploited in the wild. Both were discovered internally by Google's Threat Analysis Group (TAG) on March 10, 2026, with patches shipped within two days.

CVE-2026-3909 is an out-of-bounds write vulnerability (CWE-787) in the Skia 2D graphics library, which serves as the core rendering engine for Google Chrome, ChromeOS, Android, and Flutter. The flaw allows a remote attacker to perform out-of-bounds memory access via a specially crafted HTML page. Memory corruption in Skia can lead to arbitrary code execution in the renderer process context. When chained with other bugs, an out-of-bounds write in Skia can potentially enable sandbox escape from the renderer process. Skia processes all visual content rendered in the browser — fonts, vector graphics, images, and UI elements — making it a high-value target for attackers.

CVE-2026-3910 is an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine. Classified under CWE-94 (Code Injection) and CWE-119 (Improper Restriction of Operations within Memory Buffer Bounds), this flaw enables a remote attacker to execute arbitrary code inside the V8 sandbox via a crafted HTML page. V8 vulnerabilities are particularly dangerous because they can be triggered simply by directing victims to malicious or compromised websites — no file download or user interaction beyond navigation is required. Two public proof-of-concept exploits have been reported on GitHub (Chromium issue 491410818).

Both vulnerabilities share an identical CVSS 3.1 score of 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — indicating network-accessible, low-complexity attacks requiring only user interaction (visiting a malicious page) with high impact to confidentiality, integrity, and availability.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on March 13, 2026, establishing a federal remediation deadline of March 27, 2026 under Binding Operational Directive 22-01. This marks the third actively exploited Chrome zero-day of 2026, following CVE-2026-2441 (use-after-free in CSS handling) patched in February.

The attack surface extends beyond Chrome to all Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi. Exploitation delivery vectors observed in similar browser zero-day campaigns include spear-phishing links, watering hole compromises of legitimate websites, malvertising through ad networks, and compromised developer tooling or forums. Google has deliberately withheld exploitation details and threat actor attribution to prevent additional weaponization while users update.

The combined impact of these two vulnerabilities is severe: CVE-2026-3909 provides memory corruption capability in the graphics pipeline, while CVE-2026-3910 enables code execution in the JavaScript engine. If chained together, an attacker could potentially achieve full renderer compromise and, combined with a sandbox escape, gain arbitrary code execution on the host system.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1176 Software Extensions
- T1068 Exploitation for Privilege Escalation
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1211 Exploitation for Stealth
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1056 Input Capture
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/03/13/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [Chrome Stable Channel Update for Desktop (March 12, 2026)](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html)
- [NVD — CVE-2026-3909](https://nvd.nist.gov/vuln/detail/CVE-2026-3909)
- [NVD — CVE-2026-3910](https://nvd.nist.gov/vuln/detail/CVE-2026-3910)
- [Chromium Issue Tracker — 491410818](https://issues.chromium.org/issues/491410818)
- [Google Fixes Two Chrome Zero-Days Exploited in the Wild — The Hacker News](https://thehackernews.com/2026/03/google-fixes-two-chrome-zero-days.html)
- [Google Fixes Two New Chrome Zero-Days Exploited in Attacks — BleepingComputer](https://www.bleepingcomputer.com/news/google/google-fixes-two-new-chrome-zero-days-exploited-in-attacks/)
- [U.S. CISA Adds Google Chrome Flaws to KEV Catalog — SecurityAffairs](https://securityaffairs.com/189411/security/u-s-cisa-adds-google-chrome-flaws-to-its-known-exploited-vulnerabilities-catalog.html)
- [Chrome 146 Update Patches Two Exploited Zero-Days — SecurityWeek](https://www.securityweek.com/chrome-146-update-patches-two-exploited-zero-days/)
- [CVE-2026-3910: Chrome V8 Zero-Day Used for In-the-Wild Attacks — SOC Prime](https://socprime.com/blog/cve-2026-3910-vulnerability/)
- [Google Patches Two Chrome Zero-Days Under Active Attack — Malwarebytes](https://www.malwarebytes.com/blog/news/2026/03/google-patches-two-chrome-zero-days-under-active-attack-update-now)
- [Google Rushes Chrome Update to Fix Zero-Days Under Attack — The Register](https://www.theregister.com/2026/03/13/google_zeroday_chrome_update/)
- [Chrome Zero-Day Vulnerabilities Actively Exploited — CybersecurityNews](https://cybersecuritynews.com/chrome-zero-day-vulnerabilities-actively-exploited/)
- [Two Newly Discovered Chrome Zero-Days Exploited in the Wild — GBHackers](https://gbhackers.com/two-newly-discovered-chrome-zero-days-exploited/)
- [CVE-2026-3909 and CVE-2026-3910 Chrome Fixes — Purple Ops](https://www.purple-ops.io/resources-hottest-cves/cve-2026-3909-3910-chrome/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0230