Loading story…
CISA added two Google Chrome vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after Google disclosed active exploitation in the wild. The flaws are CVE-2026-3909, an out-of-bounds write in Skia, and CVE-2026-3910, a Chromium V8 memory-safety issue that can allow arbitrary code execution inside the browser sandbox via a crafted HTML page. Google rated both issues as high severity with CVSS 8.8 and released fixes in Chrome 146.0.7680.75/76 for Windows and Mac and 146.0.7680.75 for Linux.
CISA's KEV entry states that CVE-2026-3910 may affect multiple Chromium-based browsers, including Google Chrome, Microsoft Edge, and Opera, while CVE-2026-3909 impacts the shared Skia component and may affect Chrome, ChromeOS, Android, Flutter, and other products depending on vendor implementation. Federal agencies were directed to apply vendor mitigations or discontinue use if fixes are unavailable, with a remediation due date of 2026-03-27. Neither source attributes the exploitation to a specific threat actor, but both confirm the vulnerabilities are being exploited and require prompt patching.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
In the same March 13, 2026 KEV update, CISA added CVE-2025-68613 in n8n, an SSRF flaw in Omnissa Workspace ONE UEM, and an unsafe deserialization issue in SolarWinds Web Help Desk. The entries directed agencies to apply vendor mitigations, follow cloud-service guidance, or discontinue use if mitigations were unavailable.
CISA added CVE-2026-3909 and CVE-2026-3910 to its Known Exploited Vulnerabilities catalog after Google confirmed active exploitation in the wild. The agency set a remediation deadline of March 27, 2026 for Federal Civilian Executive Branch agencies under BOD 22-01.
Microsoft released Edge version 126.0.2592.68 to address exposure related to the Chromium vulnerabilities CVE-2026-3909 and CVE-2026-3910. This extended remediation beyond Chrome to another Chromium-based browser.
Google released Chrome stable updates 146.0.7680.75/76 for Windows and Mac and 146.0.7680.75 for Linux to fix CVE-2026-3909 and CVE-2026-3910. The updates addressed two high-severity vulnerabilities that could be triggered via crafted web content.
Google reported CVE-2026-3909 and CVE-2026-3910 internally on March 10, 2026. The flaws affect Chrome's Skia graphics library and Chromium's V8 engine and were later confirmed as actively exploited in the wild.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcesecurityaffairs.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Google Chrome** received a security update for **CVE-2026-3909**, an **out-of-bounds write** flaw in the **Skia** graphics component, and **CISA** added the vulnerability to its **Known Exploited Vulnerabilities (KEV)** catalog. The issue affects Chrome desktop versions prior to `146.0.7680.80` on Windows, macOS, and Linux, and CISA’s KEV entry states the bug could allow a remote attacker to trigger out-of-bounds memory access through a crafted HTML page. The KEV record also notes that the vulnerable component is widely used and may affect **ChromeOS, Android, Flutter, and other products** depending on vendor implementation and patch status. The available reporting indicates **active exploitation awareness** at the time of disclosure, elevating the issue from a routine browser patch to a priority remediation item. Canadian Centre for Cyber Security guidance directs administrators to review Google’s advisory and apply updates, while the KEV entry instructs organizations to follow vendor mitigations, comply with applicable **BOD 22-01** requirements for cloud services, or discontinue use if no mitigation is available. Other advisories in the set cover unrelated vendor and ICS vulnerability bulletins and do not describe the same specific event.
Jun 29, 2026
CISA has added the Google Chromium vulnerability CVE-2025-14174 to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. This high-severity flaw, found in the ANGLE graphics abstraction layer used by Chromium-based browsers, allows out-of-bounds memory access due to improper buffer sizing in the Metal renderer. The vulnerability affects Google Chrome on macOS prior to version 143.0.7499.110, with related fixes also applied to Windows and Linux builds. Exploitation of this vulnerability can lead to memory corruption, browser crashes, or potentially arbitrary code execution within the browser context. Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch agencies are required to remediate this vulnerability by the specified deadline, while CISA strongly encourages all organizations to prioritize patching. The addition of CVE-2025-14174 to the KEV catalog highlights its active exploitation and the significant risk it poses to federal and other enterprise environments. Organizations are urged to update affected systems promptly to mitigate the threat posed by this vulnerability.
Jun 29, 2026
CISA has added CVE-2025-10585, a type confusion vulnerability in Google Chromium's V8 engine, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. Google released a security update for Chrome addressing this zero-day, which is the sixth such exploited vulnerability in 2025. Federal agencies are required to remediate this vulnerability by October 14, 2025, and all organizations are strongly urged to prioritize patching.
Jun 29, 2026