CVE-2026-3910

Overview

CVE-2026-3910 is a vulnerability in V8, the JavaScript and WebAssembly engine used by Google Chrome and all Chromium-based browsers. An inappropriate implementation in V8 allows a remote attacker to execute arbitrary code inside a sandbox by luring a victim to a crafted HTML page. Chromium rates this vulnerability as High severity.

This CVE was added to the CISA KEV catalog on the same day as CVE-2026-3909 (Skia out-of-bounds write), both fixed in Chrome 146.0.7680.75. The simultaneous KEV listing of a V8 code execution flaw alongside a Skia memory corruption bug suggests these may have been observed in a chained exploit — using the V8 bug for initial code execution within the sandbox, and the Skia bug for sandbox escape or additional memory corruption.

V8 Engine & Exploitation Context

V8 is Google's open-source JavaScript and WebAssembly engine, written in C++ and used in Chrome, Node.js, Deno, and all Chromium-based browsers. V8 vulnerabilities are among the most dangerous browser flaws because they can be triggered simply by processing JavaScript on a web page — making them prime targets for:

• Zero-day exploit chains — V8 bugs are frequently used as the initial code execution primitive, combined with sandbox escape exploits for full system compromise
• Commercial spyware — vendors like NSO Group, Intellexa, and Candiru have historically leveraged V8 vulnerabilities in their exploit chains targeting journalists, activists, and government officials
• State-sponsored campaigns — nation-state actors regularly target V8 for watering hole attacks and targeted phishing
• Drive-by downloads — malvertising networks exploit V8 bugs to execute code when victims simply visit a compromised or malicious website

Paired KEV Entry with CVE-2026-3909

Vulnerability Description

Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

The "inappropriate implementation" classification in Chromium's vulnerability taxonomy indicates a logical flaw in V8's code — distinct from typical memory corruption bugs. This could involve incorrect handling of JavaScript or WebAssembly type transitions, JIT compiler optimizations that produce incorrect machine code, or improper bounds checking during runtime operations.

The vulnerability enables arbitrary code execution within Chrome's renderer sandbox. While the sandbox limits the attacker's initial access, the code execution capability is a critical first step in browser exploitation:

• Read/write sensitive renderer memory — access cookies, session tokens, form data, and DOM content from all tabs in the same process
• Stage sandbox escape — use the foothold to exploit additional vulnerabilities (e.g., IPC bugs, kernel bugs, or companion vulnerabilities like CVE-2026-3909)
• Exfiltrate data — steal information from the current browsing context before the user navigates away
• Inject content — modify rendered pages to phish credentials or redirect payments

Affected Products & Versions

Google Chrome

Other Affected Products

V8 is the JavaScript engine for all Chromium-based browsers and runtimes. The following products embed V8 and are independently affected:

Impact

Remediation

Immediate Actions

1. Update Google Chrome to version 146.0.7680.75 or later on all platforms
2. Update all Chromium-based browsers — Microsoft Edge, Brave, Opera, and Vivaldi will release corresponding patches
3. Update Electron-based applications — VS Code, Slack, Discord, Teams, and other Electron apps bundle their own Chromium/V8
4. Verify auto-update — navigate to chrome://settings/help and confirm Chrome is current
5. Restart the browser — Chrome updates require a restart to take effect; pending updates leave the system vulnerable

Mitigations (if patching is delayed)

• Chrome's Site Isolation (enabled by default) limits cross-origin data access even with renderer compromise
• Use browser policies to restrict navigation to untrusted or unknown sites
• Deploy web content filtering to block known malicious domains and URLs
• Consider enabling V8 mitigations via Chrome flags where available for high-risk environments

Related Vulnerabilities