---
title: "Chrome V8 CVE-2026-3910: Exploited Zero-Day, March 2026"
url: https://erroneo.us/security/briefs/chrome-v8-cve-2026-3910-exploited-zero-day/
description: "V8 flaw exploited as a zero-day, fixed in Chrome 146.0.7680.75 on Mar 12, 2026 and Edge 146.0.3856.59. Auto-updated browsers are safe; check pinned fleets."
type: security-brief
section: "Security Digest"
date_published: 2026-03-12
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-3910"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Chrome V8 CVE-2026-3910: Exploited Zero-Day, March 2026

**Verdict: Check exposure.** Chrome and Edge fixed this exploited V8 bug within a day in March 2026 and have auto-updated for seven months since; what is left is pinned fleets, frozen images and embedded Chromium that never took 146.0.7680.75.

- **Who must act:** Admins of fleets where Chrome or Edge updates are pinned, deferred or broken, owners of kiosk and VDI images built before mid-March 2026, and anyone running Electron apps on older Chromium.
- **Who can relax:** Anyone on Chrome 146.0.7680.80 or later or Edge 146.0.3856.62 or later (which also covers the companion Skia zero-day), including every auto-updating install relaunched since late March 2026.
- **Affected:** Google Chrome before 146.0.7680.75 (Windows, Linux) and before 146.0.7680.76 (Mac); Chrome for Android before the March 12, 2026 release; Microsoft Edge before 146.0.3856.59; Electron apps on Chromium older than 146.0.7680.75 without a vendor backport; Other Chromium-based browsers until their vendors ship the V8 fix
- **Fixed:** Chrome 146.0.7680.75/.76 Windows and Mac, 146.0.7680.75 Linux (Mar 12, 2026); Chrome 146.0.7680.80 (Mar 13, 2026), which also fixes the Skia zero-day CVE-2026-3909; Chrome for Android release of Mar 12, 2026 (same security fixes as desktop 146.0.7680.75/.76); Microsoft Edge 146.0.3856.59 (Mar 13, 2026); 146.0.3856.62 (Mar 16) for CVE-2026-3909; Electron 41.0.3 (Chromium 146.0.7680.80, Mar 17, 2026)
- **CVEs:** CVE-2026-3910
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Open chrome://settings/help (or edge://settings/help), relaunch if an update is pending, and confirm the version is at least 146.0.7680.80 (Edge 146.0.3856.62); current Chrome is 156.
2. In managed fleets, report browser versions and flag anything below Chrome 146.0.7680.80 or Edge 146.0.3856.62.
3. Remove policies that pin Chrome or Edge to an old version or defer updates indefinitely, and enable relaunch notifications.
4. Rebuild kiosk, VDI and golden images that bake in a browser.
5. Ask Electron app vendors which Chromium their build carries and whether it includes the March 2026 V8 fix; Electron 41.0.3 and later do.

### How to check if you are affected

- Query endpoint inventory for Chrome, Edge or Chromium builds below the fixed versions at any point since mid-March 2026, and list the users of those machines.
- Google has published no indicators for this exploit; for high-risk users who ran unpatched builds in March 2026, review EDR for browser processes spawning unexpected executables and for new persistence around that time.

## What happened

On March 12, 2026, Google released Chrome 146.0.7680.75/76 for Windows and Mac and 146.0.7680.75 for Linux. The release fixed one vulnerability, [CVE-2026-3910](https://www.cve.org/CVERecord?id=CVE-2026-3910), which Google describes as an "inappropriate implementation" in V8, Chrome's JavaScript and WebAssembly engine. Google's Threat Analysis Group (TAG) reported it on March 10. The [release notes](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html) state: "Google is aware that an exploit for CVE-2026-3910 exists in the wild." The CVE record says a crafted HTML page could "execute arbitrary code inside a sandbox." That means code runs in the renderer, and a full compromise usually needs a second bug to escape the sandbox.

CISA lists the flaw as an improper restriction of operations within a memory buffer (CWE-119). It added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3910) on March 13, 2026, with a March 27 deadline. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-3910) scores it CVSS 3.1 8.8. Google has not said who exploited it or how.

The fix came with a companion bug. Google's first version of the notes also listed CVE-2026-3909, an exploited out-of-bounds write in Skia that TAG reported the same day. On March 13 Google moved that fix to [Chrome 146.0.7680.80](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html). Some early coverage, including [BleepingComputer](https://www.bleepingcomputer.com/news/google/google-fixes-two-new-chrome-zero-days-exploited-in-attacks/), reported both as fixed in .75/.76. In practice, 146.0.7680.80 is the build that closes both.

## Who is affected

Chrome before 146.0.7680.75 on desktop, and Chromium-based software that has not taken the V8 fix. These fixes are verified:

- The [Chrome for Android release of March 12](https://chromereleases.googleblog.com/2026/03/chrome-for-android-update_12.html), which Google says carries the same security fixes as desktop 146.0.7680.75/.76.
- Microsoft Edge 146.0.3856.59 (March 13) for CVE-2026-3910, and 146.0.3856.62 (March 16) for the Skia bug, per Microsoft's [Edge security notes](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security).
- Electron [41.0.3](https://github.com/electron/electron/releases/tag/v41.0.3), which moved to Chromium 146.0.7680.80 on March 17.

Electron's notes for its 39.x and 40.x lines name the Skia backport but not this V8 fix. For apps on those lines, ask the vendor.

## Do you really need to act?

Most people do not. Chrome and Edge auto-update, and Chrome Stable reached [156](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html) on October 20, 2026. Exposure lingers in a few places:

- Fleets that pin or defer browser updates.
- Kiosk and VDI images frozen before mid-March.
- Users who never relaunch.
- Electron or other embedded-Chromium apps whose vendors lag.

Those are worth finding. They are not a reason to panic seven months on.

## What to do now

1. Check versions with `google-chrome --version`, or on Windows with `(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion`. Aim for at least 146.0.7680.80, and Edge at least 146.0.3856.62.
2. In endpoint inventory, flag machines below those builds.
3. Review `chrome://policy` on managed machines. Remove version pins or indefinite deferrals, and enable `RelaunchNotification`.
4. Rebuild kiosk, VDI and golden images that bake in a browser.
5. On macOS, read an Electron app's version with `defaults read "/Applications/App.app/Contents/Frameworks/Electron Framework.framework/Resources/Info.plist" CFBundleVersion`. Treat anything below 41.0.3 as unconfirmed until its vendor says otherwise.

## How to tell if you were hit

Google has published no indicators of compromise, and no public report ties the exploit to a named actor or campaign as of Oct 23, 2026. Start from inventory: which machines ran Chrome or Edge below the fixed builds after March 10, and who used them? For high-risk users in that group, review EDR telemetry from that window. Look for browser processes spawning unexpected executables, and for new services, scheduled tasks or launch agents.

## Timeline

- Mar 10, 2026 — Google TAG reports CVE-2026-3910, along with the Skia bug.
- Mar 12, 2026 — Chrome 146.0.7680.75/76 ships, Google confirms an in-the-wild exploit, and the CVE is published.
- Mar 13, 2026 — Chrome 146.0.7680.80 fixes the Skia bug, and Edge 146.0.3856.59 fixes CVE-2026-3910. CISA adds the CVE to KEV.
- Mar 17, 2026 — Electron 41.0.3 moves to Chromium 146.0.7680.80.
- Mar 27, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [Google Chrome Releases — Stable Channel Update for Desktop (Mar 12, 2026)](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html)
2. [Google Chrome Releases — Stable Channel Update for Desktop (Mar 13, 2026)](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html)
3. [Google Chrome Releases — Chrome for Android Update (Mar 12, 2026)](https://chromereleases.googleblog.com/2026/03/chrome-for-android-update_12.html)
4. [CVE record — CVE-2026-3910](https://www.cve.org/CVERecord?id=CVE-2026-3910)
5. [NVD — CVE-2026-3910](https://nvd.nist.gov/vuln/detail/CVE-2026-3910)
6. [CISA — Known Exploited Vulnerabilities: CVE-2026-3910](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3910)
7. [Microsoft — Release notes for Microsoft Edge Security Updates](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)
8. [Electron — v41.0.3 release notes](https://github.com/electron/electron/releases/tag/v41.0.3)
9. [Google Chrome Releases — Chrome 156 promoted to Stable (Oct 20, 2026)](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html)
10. [BleepingComputer — Google fixes two new Chrome zero-days exploited in attacks](https://www.bleepingcomputer.com/news/google/google-fixes-two-new-chrome-zero-days-exploited-in-attacks/)

---
Source page: https://erroneo.us/security/briefs/chrome-v8-cve-2026-3910-exploited-zero-day/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt