Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Chrome Skia and V8 exploited zero-days (multiple vulnerabilities)

Vulnerability
First reported
Last updated
Happening score
H score 31
1 unique sources, 1 articles

Summary

Hide ▲

Chrome on Windows, macOS, and Linux is affected by two high-severity zero-days, CVE-2026-3909 and CVE-2026-3910, that Google says were exploited in the wild. One flaw is an out-of-bounds write in Skia that can trigger out-of-bounds memory access from a crafted HTML page. The other is an inappropriate implementation issue in V8 that can enable arbitrary code execution inside a sandbox from a crafted HTML page. Google shipped fixes in 146.0.7680.75/76 and urged users to update immediately because the bugs were already being abused.

Related Happenings

Opera GX browser GX Mods auto-install CSS injection patched security flaw

Vulnerability
H score21 First: 06.07.2026 17:15 Last: 06.07.2026 17:15 Sources 1

About this happening: A critical Opera GX browser flaw in GX Mods let malicious websites auto-install a customization mod and inject CSS across every page, creating zero-click cross-site data...

Open Happening

Opera GX silent mod-install XS-Leak security flaw

Vulnerability
H score19 First: 06.07.2026 10:27 Last: 06.07.2026 10:27 Sources 1

About this happening: Opera GX had a flaw in its GX Mods install path that let a malicious website silently install a browser add-on and leak data from visited pages, creating no-click ex...

Open Happening

Chrome V8 JavaScript engine out-of-bounds read/write zero-day exploited in the wild (CVE-2026-11645)

Vulnerability
H score45 First: 09.06.2026 09:56 Last: 09.06.2026 09:56 Sources 1

About this happening: Google has patched CVE-2026-11645, a Chrome V8 JavaScript engine zero-day that was exploited in the wild and could let remote attackers run code inside the browser...

Open Happening

ExploitBench benchmark shows frontier AI models can stage Chrome exploit chains against vulnerable V8 builds

Technical Analysis
H score16 First: 04.06.2026 16:00 Last: 04.06.2026 16:00 Sources 1

About this happening: Bugcrowd’s ExploitBench now shows frontier AI models can progress through staged Google Chrome exploit chains, raising the risk of faster AI-assisted exploit development...

Open Happening

Chromium JavaScript background RCE flaw

Vulnerability
H score16 First: 21.05.2026 21:13 Last: 21.05.2026 21:13 Sources 1

About this happening: The unfixed Chromium flaw keeps JavaScript running after the browser is closed, creating remote code execution risk across Chromium-based browsers. A malicious sit...

Open Happening

Timeline

  1. 13.03.2026 02:00 1 articles · 4mo ago

    Google discovers and reports Chrome zero-days CVE-2026-3909 and CVE-2026-3910

    Initial Disclosure

    Google discovered and reported CVE-2026-3909 in the Skia 2D graphics library and CVE-2026-3910 in the V8 JavaScript and WebAssembly engine on March 10, 2026; both flaws were later described as high-severity Chrome vulnerabilities exploited in the wild via crafted HTML pages.

    Show sources
    Open in new tab
  2. 13.03.2026 02:00 2 articles · 4mo ago

    Google releases Chrome fixes for CVE-2026-3909 and CVE-2026-3910

    Mitigation Patch Update

    Google released Chrome security updates to address CVE-2026-3909 and CVE-2026-3910, urging users to relaunch after updating to 146.0.7680.75/76 on Windows and macOS or 146.0.7680.75 on Linux.

    Show sources
    Open in new tab