CVE-2026-3910
Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
Description
CVE-2026-3910 is a high severity vulnerability in Google Chromium's V8 JavaScript engine caused by an inappropriate implementation that enables remote code execution within the browser sandbox. An attacker can exploit this vulnerability by luring a victim to a crafted HTML page, triggering code execution in the renderer process. Affected versions include Google Chrome prior to 146.0.7680.75. With a CVSS v3.1 score of 8.8 (HIGH) and an EPSS score of 11.2%, CVE-2026-3910 represents a significant threat to all Chromium-based browser users. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on March 13, 2026, with a remediation deadline of March 27, 2026.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 146.0.7680.75 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html(Release Notes, Vendor Advisory)
- https://issues.chromium.org/issues/491410818(Permissions Required)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3910(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
CVE-2026-3910 is classified under CWE-94 (Code Injection). This weakness occurs when an application constructs or generates code using externally-influenced input without adequately neutralizing special elements, allowing an attacker to inject and execute arbitrary code.
In CVE-2026-3910, the V8 JavaScript engine's implementation contains a flaw in code generation that can be exploited through carefully crafted JavaScript. The inappropriate implementation allows an attacker to break out of normal V8 execution constraints and achieve arbitrary code execution within the Chromium renderer sandbox.
Learn more: CWE-94 — Code Injection
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-3910 also falls under CWE-119 (Buffer Errors). The V8 implementation flaw leads to operations that read or write memory outside the intended buffer boundaries. V8's just-in-time (JIT) compiler may generate incorrect machine code that fails to enforce memory safety constraints, enabling an attacker to corrupt adjacent memory and hijack control flow.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2026-3910 carries a CVSS v3.1 base score of 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack is network-accessible with low complexity and requires no privileges, but does require user interaction in the form of visiting a malicious web page. The scope is Unchanged.
Confidentiality (High): Successful exploitation allows the attacker to execute code within the Chromium renderer process, which has access to the content of the current tab and potentially cross-origin data through further exploitation. The attacker can read sensitive page content, steal authentication cookies and session tokens, and access data from other origins if the sandbox is escaped through a chained exploit.
Integrity (High): The attacker gains code execution within the renderer, enabling modification of displayed web content, injection of malicious scripts into trusted pages, interception and modification of form submissions, and installation of persistent JavaScript payloads.
Availability (High): The attacker can crash the browser process, corrupt memory to cause instability, or leverage the code execution for denial of service. In targeted attacks, the availability impact may be secondary to the espionage or data theft objectives.
While the code execution occurs within the Chromium sandbox (limiting the Unchanged scope), the EPSS score of 11.2% and KEV listing indicate active exploitation. V8 vulnerabilities are frequently chained with sandbox escape exploits for full system compromise, and the sandbox boundary should not be considered a reliable containment for determined attackers.
Exploit Maturity
CVE-2026-3910 demonstrates high exploit maturity with confirmed active exploitation in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on March 13, 2026, with a remediation deadline of March 27, 2026. The EPSS score of 11.2% confirms significant exploitation probability.
Chrome V8 vulnerabilities are among the most valuable and actively exploited browser flaws. They are frequently used in targeted attacks by both nation-state actors and commercial spyware vendors. Previous V8 vulnerabilities have been weaponized by groups such as Lazarus (North Korea), APT29 (Russia), and commercial surveillance companies like NSO Group and Intellexa. The exploitation pattern typically involves watering hole attacks or spear-phishing links that direct victims to attacker-controlled web pages hosting the exploit.
While CVE-2026-3910 achieves code execution within the renderer sandbox, sophisticated attackers routinely chain renderer exploits with sandbox escape vulnerabilities for full system compromise. The confirmed KEV listing suggests that at least one threat actor has developed a reliable exploit, and the technique may spread to additional actors as exploit details emerge. All Chromium-based browsers (Chrome, Edge, Brave, Opera, and others) are affected until updated.
Remediation
-
Update Google Chrome to version 146.0.7680.75 or later immediately. This update is available through Chrome's built-in update mechanism. Navigate to chrome://settings/help to verify the current version and trigger an update. Restart the browser after updating to ensure the patched version is active.
-
Update all Chromium-based browsers. The vulnerability affects the V8 engine shared by all Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi. Check each browser for available updates and apply them immediately.
-
Enable automatic browser updates organization-wide. Ensure that Chrome and other Chromium-based browsers are configured for automatic updates through Group Policy, MDM, or enterprise management tools. Verify that update mechanisms are not blocked by proxy servers or firewall rules.
-
Implement browser isolation for high-risk users. Deploy remote browser isolation (RBI) solutions for users who handle sensitive data or are high-value targets. Browser isolation renders web content on remote servers, preventing exploitation of client-side browser vulnerabilities from reaching the endpoint.
-
Deploy URL filtering and web content inspection. Block access to known malicious domains and implement web proxy inspection to detect and block exploit delivery pages. Integrate threat intelligence feeds that track active V8 exploit campaigns.
-
Monitor endpoints for post-exploitation indicators. V8 exploits often serve as the initial stage of a multi-step attack chain. Monitor for unusual child processes spawned by browser processes, unexpected network connections from renderer processes, and signs of sandbox escape or privilege escalation.
Technical Details
CVE-2026-3910 is an inappropriate implementation vulnerability in the V8 JavaScript engine used by Google Chromium. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, yielding a score of 8.8. The vulnerability exists in V8's handling of JavaScript code, where an implementation flaw in the JIT compiler or interpreter allows an attacker to achieve arbitrary code execution within the Chromium renderer process sandbox. The attack vector requires user interaction (UI:R) because the victim must navigate to a web page containing the malicious HTML and JavaScript payload. The attacker crafts JavaScript that triggers the V8 implementation bug, leading to memory corruption or type confusion that enables control flow hijacking. The code executes within the Chromium renderer sandbox, which limits direct access to the operating system. However, the sandbox provides defense-in-depth rather than an absolute boundary, and sophisticated attackers routinely chain renderer exploits with sandbox escapes. Affected versions include all Chromium-based browsers using V8 prior to the version shipped with Chrome 146.0.7680.75.
Frequently Asked Questions
Is CVE-2026-3910 being actively exploited?
Yes. CISA added CVE-2026-3910 to the Known Exploited Vulnerabilities catalog on March 13, 2026. Chrome V8 vulnerabilities are high-value targets for nation-state actors and commercial spyware vendors.
What products are affected by CVE-2026-3910?
All Chromium-based browsers are affected, including Google Chrome, Microsoft Edge, Brave, Opera, and Vivaldi. Chrome versions prior to 146.0.7680.75 are vulnerable. Other Chromium-based browsers should be updated to versions that incorporate the fixed V8 engine.
How do I fix CVE-2026-3910?
Update Google Chrome to version 146.0.7680.75 or later. Also update all other Chromium-based browsers. Navigate to the browser's about page or settings to check the version and trigger updates.
How severe is CVE-2026-3910?
With a CVSS score of 8.8 (HIGH), active exploitation, and an EPSS of 11.2%, CVE-2026-3910 is a serious threat. While code execution occurs within the browser sandbox, V8 exploits are frequently chained with sandbox escapes for full system compromise. All Chromium-based browser users are at risk until updated.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.