CVE-2026-3910

8.8

HIGH CVSS 3.1

Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability - [Actively Exploited]

Overview

Description

Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Details

INFO

Published Date :

March 13, 2026, 7:55 p.m.

Last Modified :

March 13, 2026, 10 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Mar 27, 2026

Alert Date: Mar 13, 2026 | 23 days ago

Description :

Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-3910

Impact

Affected Products

The following products are affected by CVE-2026-3910 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Microsoft	windows
2	Microsoft	edge_chromium
1	Linux	linux_kernel
1	Google	chrome
1	Apple	macos

: Total Affected Vendor : 4 | Products : 5

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				134c704f-9b21-4f2e-91b3-4a467353bcc0
	CVSS 3.1	HIGH				[email protected]

Solution

Update Chrome to patch a V8 sandbox escape vulnerability allowing remote code execution.

Update Google Chrome to version 146.0.7680.75 or later.
Apply vendor security patches promptly.
Educate users on safe browsing practices.

Public PoC/Exploit Available at Github

CVE-2026-3910 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-3910.

URL	Resource
https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html	Vendor Advisory Release Notes
https://issues.chromium.org/issues/491410818	Permissions Required
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3910	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-3910 is associated with the following CWEs:

CWE-94: Improper Control of Generation of Code ('Code Injection')

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-3910 weaknesses.

CAPEC-35: Leverage Executable Code in Non-Executable Files Leverage Executable Code in Non-Executable Files CAPEC-77: Manipulating User-Controlled Variables Manipulating User-Controlled Variables CAPEC-242: Code Injection Code Injection CAPEC-8: Buffer Overflow in an API Call Buffer Overflow in an API Call CAPEC-9: Buffer Overflow in Local Command-Line Utilities Buffer Overflow in Local Command-Line Utilities CAPEC-10: Buffer Overflow via Environment Variables Buffer Overflow via Environment Variables CAPEC-14: Client-side Injection-induced Buffer Overflow Client-side Injection-induced Buffer Overflow CAPEC-24: Filter Failure through Buffer Overflow Filter Failure through Buffer Overflow CAPEC-42: MIME Conversion MIME Conversion CAPEC-44: Overflow Binary Resource File Overflow Binary Resource File CAPEC-45: Buffer Overflow via Symbolic Links Buffer Overflow via Symbolic Links CAPEC-46: Overflow Variables and Tags Overflow Variables and Tags CAPEC-47: Buffer Overflow via Parameter Expansion Buffer Overflow via Parameter Expansion CAPEC-100: Overflow Buffers Overflow Buffers CAPEC-123: Buffer Manipulation Buffer Manipulation

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Nirav9369/chrome-zero-day-analysis

None

Updated: 3 days, 10 hours ago

0 stars 0 fork 0 watcher

Born at : April 2, 2026, 7:44 a.m. This repo has been linked 2 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-3910 vulnerability anywhere in the article.

SentinelOne

The Good, the Bad and the Ugly in Cybersecurity – Week 14

The Good | SentinelOne AI EDR Stops LiteLLM Supply Chain Attack in Real Time This week, SentinelOne demonstrated how autonomous, AI-driven endpoint protection can detect and stop sophisticated supply ...

Published Date: Apr 03, 2026 (2 days, 5 hours ago)

SentinelOne

The Good, the Bad and the Ugly in Cybersecurity – Week 14

Published Date: Apr 03, 2026 (2 days, 5 hours ago)

TheCyberThrone

CVE-2026-5281 — Google Chrome Dawn Use-After-Free Under Active Exploitation

April 2, 2026CISA has added CVE-2026-5281 to its Known Exploited Vulnerabilities catalog, marking the fourth Chrome zero-day exploited in the wild during 2026 alone. Federal agencies are required to r ...

Published Date: Apr 02, 2026 (3 days, 16 hours ago)

The Hacker News

New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch Released

Google on Thursday released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild. The high-severity vulnerab ...

Published Date: Apr 01, 2026 (4 days, 6 hours ago)

CybersecurityNews

CISA Warns of Chrome 0-Day Vulnerabilities Exploited in Attacks

CISA Warns of Chrome 0-Day Vulnerabilities Exploit An urgent warning regarding two highly critical zero-day vulnerabilities affecting Google Chrome and related products. These flaws have been official ...

Published Date: Mar 17, 2026 (2 weeks, 5 days ago)

Daily CyberSecurity

Weekly Threat Intelligence Briefing: Chrome Zero-Days, SolarWinds RCE, and a Surge in Critical PoCs

The Executive Summary Over the past seven days, our CVE Watchtower intercepted 1,388 new vulnerabilities, highlighting a relentless week in the cybersecurity landscape. While the sheer volume is high, ...

Published Date: Mar 16, 2026 (2 weeks, 6 days ago)

security.nl

Google meldde ten onrechte dat Chrome-lek was gedicht, rolt nieuwe update uit

Google heeft eerder deze week ten onrechte gemeld dat een actief aangevallen kwetsbaarheid in Chrome was verholpen, en heeft nu een nieuwe update uitgerold om gebruikers te beschermen. Op 12 maart waa ...

Published Date: Mar 14, 2026 (3 weeks, 1 day ago)

TheCyberThrone

CISA Adds Two Google Chrome Zero-Days to KEV

March 14, 2026CISA has updated its Known Exploited Vulnerabilities (KEV) catalog with two newly confirmed zero-days affecting Google Chrome — CVE-2026-3909 and CVE-2026-3910. Both vulnerabilities are ...

Published Date: Mar 14, 2026 (3 weeks, 1 day ago)

The Register

Google rushes Chrome update fixing two zero-days already under attack

Google has pushed out an emergency Chrome update to fix two previously unknown vulnerabilities that attackers were already exploiting before the patches landed. The bugs, tracked as CVE-2026-3909 and ...