Code Execution Vulnerability in Google Chrome Products
CVE-2026-3910

8.8HIGH

Key Information:

Vendor

Google
Status
Chrome
Vendor
CVE Published:
12 March 2026

Badges

📈 Score: 424👾 Exploit Exists🟣 EPSS 11%🦅 CISA Reported

What is CVE-2026-3910?

CVE-2026-3910 is a critical code execution vulnerability found in Google Chrome products, stemming from an inappropriate implementation within the V8 JavaScript engine. This vulnerability affects versions of the software prior to 146.0.7680.75, potentially allowing remote attackers to execute arbitrary code within a sandbox environment by utilizing a specially crafted HTML page. Given the widespread use of Google Chrome as a web browser in numerous organizations, the implications of this vulnerability could be considerable. Attackers leveraging this flaw could gain unauthorized access to sensitive data, compromise system integrity, and affect overall browser performance, thereby putting organizations at significant risk.

Potential impact of CVE-2026-3910

  1. Arbitrary Code Execution: The most severe impact is that an attacker could execute malicious code on a user’s system without their consent. This can lead to unauthorized access to sensitive information, manipulation of files, or installation of additional malware.

  2. Data Compromise: Successful exploitation could result in the leakage of personal or business-related data. It opens a gateway for attackers to access confidential information stored in browser sessions or related applications.

  3. System Integrity and Security Risks: Organizations may face potential system breaches where compromised browsers can be used to launch further attacks, disrupt services, or install more sophisticated malware, escalating the threat level across the network.

CISA has reported CVE-2026-3910

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-3910 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Chrome 146.0.7680.75

References

https://chromereleases.googleblog.com/2026/03/stable-chan...
https://issues.chromium.org/issues/491410818

EPSS Score

11% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

JSON
.