Loading vulnerability…
Sandboxed arbitrary code execution in Google Chrome V8
CVE-2026-3910 is an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine in Google Chrome before version 146.0.7680.75. A remote attacker can trigger the flaw through a crafted HTML page to execute arbitrary code inside the browser sandbox. Chromium classifies the vulnerability as High severity, and it has been actively exploited. The specific vulnerable function and underlying implementation defect have not been identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises code execution within the browser sandbox; this vulnerability alone does not establish sandbox escape or operating-system compromise. In the Poisoned Source campaign, attributed to APT29 with moderate-to-high confidence, attackers chained it with the Adreno graphics driver vulnerability CVE-2025-27038 to escape the sandbox, escalate privileges, and deploy AndroSnitch on Android devices. The payload stole Chrome cookies, saved credentials, browsing history, and Wi-Fi credentials without establishing persistence. Stolen cookies could enable authenticated-session hijacking.
If you can’t patch tonight, do this now.
Reduce exposure to malicious or compromised websites and audit third-party scripts, particularly analytics integrations used to deliver drive-by exploits. Review browser and network telemetry for evidence of exploitation. A reboot can interrupt the nonpersistent payloads observed in the Android campaign, but it does not fix the vulnerability, reverse data theft, or prevent reinfection when a vulnerable device revisits an exploit-serving page.
Patch, then assume compromise.
Upgrade Google Chrome to version 146.0.7680.75 or later, preferably the latest supported stable release. Chrome 146.0.7680.80 is also identified as a patched deployment target for Windows, macOS, and Linux. Apply Microsoft-provided security updates to affected Microsoft Edge installations. On Android, also install operating-system and graphics-driver security updates to address companion vulnerabilities used in exploit chains, and replace devices that no longer receive security updates.
No validated public exploits yet. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
128 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.