Google Fixes Two New Chrome Zero-Days Exploited in Attacks

Why It Matters

Active exploitation of browser core components threatens user data and corporate networks; swift patch deployment limits the attack window and reinforces trust in Chrome’s security model.

Key Takeaways

• Two Chrome zero‑days patched: CVE‑2026‑3909 (Skia) and CVE‑2026‑3910 (V8)
• Exploits were active in the wild before patches released
• Updates available for Windows, macOS, Linux via Chrome 146.0.7680.75/76
• Google’s VRP paid $17 M to 747 researchers in 2025
• This is the second and third exploited Chrome zero‑days in 2026

Pulse Analysis

The frequency of zero‑day disclosures in Chrome underscores the browser’s role as a critical attack surface for both nation‑state actors and cybercriminals. While Google’s rapid response—delivering patches within days—demonstrates operational maturity, the fact that multiple flaws were weaponized before public mitigation highlights the persistent challenge of balancing feature velocity with rigorous code review. Enterprises that rely on Chrome for SaaS access must treat browser updates as high‑priority patches, integrating automated rollout policies to reduce exposure.

CVE‑2026‑3909 leverages an out‑of‑bounds write in Skia, the graphics engine that renders every visual element in the browser. By corrupting memory, attackers can achieve arbitrary code execution, effectively hijacking the host system. CVE‑2026‑3910, an inappropriate implementation in V8, compromises the JavaScript engine that powers modern web applications and WebAssembly modules, opening pathways for remote code execution without user interaction. Both vulnerabilities illustrate how deep‑seated library bugs can cascade into full‑scale compromises, especially when exploited through crafted web pages or malicious ads.

Google’s broader security ecosystem—its Threat Analysis Group, coordinated disclosure framework, and a $17 million bounty program—plays a pivotal role in surfacing these flaws before they cause widespread damage. The sizable payouts to nearly 750 researchers signal a market‑driven incentive structure that encourages responsible reporting. However, the lag between exploit detection and universal patch adoption remains a risk, particularly for organizations with legacy systems or delayed update cycles. Strengthening automated update mechanisms and diversifying defense layers, such as employing browser isolation, will be essential for mitigating future zero‑day threats.