Chrome V8 CVE-2026-3910: Exploited Zero-Day, March 2026

What to do

1. Open chrome://settings/help (or edge://settings/help), relaunch if an update is pending, and confirm the version is at least 146.0.7680.80 (Edge 146.0.3856.62); current Chrome is 156.
2. In managed fleets, report browser versions and flag anything below Chrome 146.0.7680.80 or Edge 146.0.3856.62.
3. Remove policies that pin Chrome or Edge to an old version or defer updates indefinitely, and enable relaunch notifications.
4. Rebuild kiosk, VDI and golden images that bake in a browser.
5. Ask Electron app vendors which Chromium their build carries and whether it includes the March 2026 V8 fix; Electron 41.0.3 and later do.

How to check if you are affected or compromised

• Query endpoint inventory for Chrome, Edge or Chromium builds below the fixed versions at any point since mid-March 2026, and list the users of those machines.
• Google has published no indicators for this exploit; for high-risk users who ran unpatched builds in March 2026, review EDR for browser processes spawning unexpected executables and for new persistence around that time.

What happened#

On March 12, 2026, Google released Chrome 146.0.7680.75/76 for Windows and Mac and 146.0.7680.75 for Linux. The release fixed one vulnerability, CVE-2026-3910, which Google describes as an "inappropriate implementation" in V8, Chrome's JavaScript and WebAssembly engine. Google's Threat Analysis Group (TAG) reported it on March 10. The release notes state: "Google is aware that an exploit for CVE-2026-3910 exists in the wild." The CVE record says a crafted HTML page could "execute arbitrary code inside a sandbox." That means code runs in the renderer, and a full compromise usually needs a second bug to escape the sandbox.

CISA lists the flaw as an improper restriction of operations within a memory buffer (CWE-119). It added the CVE to KEV on March 13, 2026, with a March 27 deadline. NVD scores it CVSS 3.1 8.8. Google has not said who exploited it or how.

The fix came with a companion bug. Google's first version of the notes also listed CVE-2026-3909, an exploited out-of-bounds write in Skia that TAG reported the same day. On March 13 Google moved that fix to Chrome 146.0.7680.80. Some early coverage, including BleepingComputer, reported both as fixed in .75/.76. In practice, 146.0.7680.80 is the build that closes both.

Who is affected#

Chrome before 146.0.7680.75 on desktop, and Chromium-based software that has not taken the V8 fix. These fixes are verified:

• The Chrome for Android release of March 12, which Google says carries the same security fixes as desktop 146.0.7680.75/.76.
• Microsoft Edge 146.0.3856.59 (March 13) for CVE-2026-3910, and 146.0.3856.62 (March 16) for the Skia bug, per Microsoft's Edge security notes.
• Electron 41.0.3, which moved to Chromium 146.0.7680.80 on March 17.

Electron's notes for its 39.x and 40.x lines name the Skia backport but not this V8 fix. For apps on those lines, ask the vendor.

Do you really need to act?#

Most people do not. Chrome and Edge auto-update, and Chrome Stable reached 156 on October 20, 2026. Exposure lingers in a few places:

• Fleets that pin or defer browser updates.
• Kiosk and VDI images frozen before mid-March.
• Users who never relaunch.
• Electron or other embedded-Chromium apps whose vendors lag.

Those are worth finding. They are not a reason to panic seven months on.

What to do now#

1. Check versions with google-chrome --version, or on Windows with (Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion. Aim for at least 146.0.7680.80, and Edge at least 146.0.3856.62.
2. In endpoint inventory, flag machines below those builds.
3. Review chrome://policy on managed machines. Remove version pins or indefinite deferrals, and enable RelaunchNotification.
4. Rebuild kiosk, VDI and golden images that bake in a browser.
5. On macOS, read an Electron app's version with defaults read "/Applications/App.app/Contents/Frameworks/Electron Framework.framework/Resources/Info.plist" CFBundleVersion. Treat anything below 41.0.3 as unconfirmed until its vendor says otherwise.

How to tell if you were hit#

Google has published no indicators of compromise, and no public report ties the exploit to a named actor or campaign as of Oct 23, 2026. Start from inventory: which machines ran Chrome or Edge below the fixed builds after March 10, and who used them? For high-risk users in that group, review EDR telemetry from that window. Look for browser processes spawning unexpected executables, and for new services, scheduled tasks or launch agents.

Timeline#

• Mar 10, 2026 — Google TAG reports CVE-2026-3910, along with the Skia bug.
• Mar 12, 2026 — Chrome 146.0.7680.75/76 ships, Google confirms an in-the-wild exploit, and the CVE is published.
• Mar 13, 2026 — Chrome 146.0.7680.80 fixes the Skia bug, and Edge 146.0.3856.59 fixes CVE-2026-3910. CISA adds the CVE to KEV.
• Mar 17, 2026 — Electron 41.0.3 moves to Chromium 146.0.7680.80.
• Mar 27, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2026-3910 · KEV 2026-03-13 · Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Google Chrome Releases — Stable Channel Update for Desktop (Mar 12, 2026) chromereleases.googleblog.com
2. Google Chrome Releases — Stable Channel Update for Desktop (Mar 13, 2026) chromereleases.googleblog.com
3. Google Chrome Releases — Chrome for Android Update (Mar 12, 2026) chromereleases.googleblog.com
4. CVE record — CVE-2026-3910 cve.org
5. NVD — CVE-2026-3910 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2026-3910 cisa.gov
7. Microsoft — Release notes for Microsoft Edge Security Updates learn.microsoft.com
8. Electron — v41.0.3 release notes github.com
9. Google Chrome Releases — Chrome 156 promoted to Stable (Oct 20, 2026) chromereleases.googleblog.com

Coverage and analysis

1. BleepingComputer — Google fixes two new Chrome zero-days exploited in attacks bleepingcomputer.com