Google has released emergency updates to patch multiple actively exploited zero-day vulnerabilities in Chrome in early 2026, including CVE-2026-3909 (Skia out-of-bounds write) and CVE-2026-3910 (V8 inappropriate implementation). These critical flaws allow remote attackers to execute code via crafted websites, affecting desktop and mobile users. Update immediately to version 146.0.7680+. BleepingComputer BleepingComputer +3 Recent & Active Chrome Exploits (2025-2026) March 2026 (CVE-2026-3909/3910): Emergency patches for two zero-days, one in the Skia graphics library and another in the V8 JavaScript engine [3, BleepingComputer]. February 2026 (CVE-2026-2441): The first actively exploited zero-day of 2026 was patched in February, targeting Chrome, Android, and ChromeOS. February 2026 (CSS Sandbox Escape): A critical vulnerability in the CSS engine was reported to allow sandbox escapes, requiring immediate extension auditing and browser updates [2, Instagram]. December 2025 (CVE-2025-14174): An out-of-bounds memory access vulnerability in ANGLE was exploited, prompting urgent CISA action [12, The Hacker News]. September-November 2025 (CVE-2025-10585): A type confusion vulnerability in the V8 engine was actively exploited in the wild [7, YouTube]. YouTube YouTube +4 Vulnerability Types and Impact V8 Engine Vulnerabilities: The V8 JavaScript/WebAssembly engine is a frequent target for "type confusion" or "inappropriate implementation" bugs, allowing attackers to escape the browser sandbox. Out-of-Bounds (OOB) Write/Memory Access: Flaws in components like Skia or ANGLE allow attackers to write data outside intended memory areas, resulting in crashes or code execution. Remote Code Execution (RCE): Many of these exploits permit attackers to execute arbitrary code on the victim's machine, allowing them to steal data or install malware. CIS Center for Internet Security CIS Center for Internet Security +4 How to Protect Yourself Update Now: Go to chrome://settings/help to force an update to the latest version. Restart Chrome: Patches are only applied after restarting the browser. Check Extensions: Review installed extensions to ensure they are not malicious, as some attacks target browser security, per Instagram. Automatic Updates: Keep automatic updates enabled for your OS and browser
Post summary
Google released emergency patches for CVE‑2026‑3909 and CVE‑2026‑3910, both actively exploited zero‑days enabling remote code execution via Skia and V8 flaws, and urged immediate updates.
