Google Chrome: Code Execution (CVE-2026-3910)

What is affected, what to do

Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Conflicting version data — version display is hidden until the data is resolved.

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Update Google Chrome to 146.0.7680.75 or later on all managed endpoints (Windows, macOS, Linux). Updating alone is not enough: the browser must restart before the fix takes effect. Force the relaunch via policy (RelaunchNotification = 2, with a short RelaunchNotificationPeriod).
   • Patch Debian hosts: upgrade chromium to 146.0.7680.80-1deb12u1 (Bookworm) or 146.0.7680.80-1deb13u1 (Trixie), e.g. with apt update && apt install --only-upgrade chromium. For other distributions, check their security trackers for fixed package versions.
   • Microsoft Edge, Opera, Brave and other Chromium-based browsers: a patch is available from each vendor — look up the version in the vendor advisory (for Edge, the Microsoft Security Update Guide or Edge release notes). Then push the update and enforce a restart via Intune, GPO or Jamf.
   • Pull a version inventory: identify every host running Chrome below 146.0.7680.75. Fix privileged users first (domain admins, finance, OT engineering workstations), along with jump hosts.
   • Hunt for user-installed and portable browsers: Chrome under %LOCALAPPDATA%\Google\Chrome\Application in particular often bypasses central patch management. Find these installs and remove or update them.
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration/browser hardening: until restarts complete, restrict V8 JIT through policy. In Chrome, set DefaultJavaScriptJitSetting = 2 (block JIT, with exceptions via JavaScriptJitAllowedForSites); in Edge, set EnhanceSecurityMode to "Strict". This shrinks the V8 attack surface but does not replace the patch.
   • Network/web proxy: block the "Newly Registered Domains", "Uncategorized" and "Malvertising" categories at the secure web gateway. Where available, route traffic in these categories through remote browser isolation.
   • Endpoint hardening: enable ASR rules or EDR prevention policies that block child processes of browser processes. This matters because attackers typically chain this bug with a sandbox escape. Verify that site isolation and the renderer sandbox are not disabled by policy or by command-line flags (--no-sandbox).
   • IAM/least privilege: prohibit web browsing from admin accounts (tiering model, PAWs). Remove local admin rights so that a successful escape does not immediately become a full host compromise.
   • Segmentation: servers, OT systems and management networks should have no direct internet browsing. Allow egress HTTP(S) from those VLANs only through an allowlisted proxy.
   • Embedded Chromium runtimes: Electron apps and CEF-based clients ship their own V8 builds. Inventory them and ask each vendor for their patch status.
3. 03

   Runbook step 3

   Detection rules

   • Sysmon EID 1 / EDR process ancestry: a browser process spawns a shell or LOLBin. Sigma shape: ParentImage|endswith: ['\chrome.exe','\msedge.exe','\opera.exe'] AND Image|endswith: ['\cmd.exe','\powershell.exe','\wscript.exe','\mshta.exe','\rundll32.exe','\regsvr32.exe']. Treat it as high-fidelity when the parent command line contains --type=renderer.
   • Version compliance (Defender TVM, KQL): DeviceTvmSoftwareInventory | where SoftwareName has "chrome" and parse_version(SoftwareVersion) < parse_version("146.0.7680.75") | summarize by DeviceName, SoftwareVersion
   • Sysmon EID 11 / EID 7: a browser process writes executables (.exe, .dll, .ps1) outside the Downloads folder, or loads unsigned DLLs from %TEMP%. Either points to second-stage delivery after successful code execution.
   • Crash telemetry: clusters of renderer crashes (Crashpad dumps under ...\User Data\Crashpad\reports, Windows Event ID 1000 for chrome.exe/msedge.exe) shortly after visits to the same domain. Failed exploit attempts often leave exactly this trace.
   • Network (Zeek/proxy logs): first-seen visits to young or uncategorised domains, followed closely by anomalous egress from the same host (new TLS JA3/JA4 fingerprints, beaconing intervals). Pivot on domains visited by several users who also show renderer crashes.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Source: pwn.watch, NVD (NIST), Microsoft Security Update Guide, cvelistv5, CISA KEV Catalog, Debian Security Advisories, CVE.org (MITRE)

Vendors and products

• Debian Chromium
• Google Google Chrome

Weakness classes (CWE)

• CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer

  Class

  The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

  Entry at MITRE CWE-119

References & sources

• chromereleases.googleblog.com2026/03/stable-channel-update-for-desktop_12.htmlRelease notes, Vendor advisory
• issues.chromium.orgissues/491410818Permissions required
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3910government-resource, US government resource
• pwn.watchpwn.watch: Chrome zero-days CVE-2026-3909 (Skia) and CVE-2026-3910 (V8)pwn-watch
• bleepingcomputer.comBleepingComputer Chrome zero-day rounduppwn-watch