Google Patches Two Actively Exploited Chrome Zero-Days Affecting Skia and V8 Engines
Google releases emergency Chrome 146 update to fix two high-severity zero-days in the Skia graphics library and V8 JavaScript engine, both confirmed exploited in the wild.
Overview
Google released an emergency update to its Chrome browser on March 12, 2026, patching two high-severity zero-day vulnerabilities that the company confirmed are being actively exploited in the wild. The flaws, tracked as CVE-2026-3909 and CVE-2026-3910, affect the Skia 2D graphics library and the V8 JavaScript and WebAssembly engine, respectively. Both carry a CVSS score of 8.8, according to The Hacker News.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on March 13, requiring all Federal Civilian Executive Branch agencies to apply the patches by March 27, 2026.
Technical Details
CVE-2026-3909 is an out-of-bounds write vulnerability in Skia, the open-source 2D graphics library that Chrome uses to render web content and user interface elements. According to The Hacker News, a remote attacker can trigger out-of-bounds memory access through a specially crafted HTML page. Out-of-bounds write bugs are considered particularly dangerous because they allow attackers to overwrite adjacent memory regions, potentially enabling arbitrary code execution or application crashes.
CVE-2026-3910 is classified as an inappropriate implementation flaw in V8, Chrome’s JavaScript and WebAssembly engine. As reported by SecurityWeek, exploitation of this vulnerability allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Both vulnerabilities were discovered and reported internally by Google on March 10, 2026. The company has not disclosed specific details about the observed attacks, a standard practice intended to limit broader exploitation before a majority of users have applied the update.
Patched Versions
Google has rolled out fixes in Chrome version 146.0.7680.75 for Windows and Linux, and 146.0.7680.76 for macOS. Users are advised to update immediately and relaunch the browser to ensure the patched build is active. Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi are also affected and should be updated as their respective vendors release corresponding patches.
Third Chrome Zero-Day of 2026
The latest patches bring the total number of actively exploited Chrome zero-days addressed in 2026 to three. Google previously patched CVE-2026-2441, a use-after-free vulnerability in Chrome’s CSS handling, in February 2026 after it was reported by security researcher Shaheen Fazim.
Chrome zero-days discovered by Google internally have historically been linked to surveillance and espionage campaigns. Commercial spyware vendors and state-sponsored threat actors frequently target browser vulnerabilities as part of exploit chains used to compromise high-value targets, though Google has not attributed the current exploitation to any specific group.
Broader Context
The disclosure comes during a period of heightened vulnerability patching across the industry. Microsoft’s March 2026 Patch Tuesday addressed 84 flaws including two publicly disclosed zero-days, while Adobe and SAP also released security updates for multiple products. The pace of zero-day exploitation continues to challenge defenders, with CISA’s KEV catalog serving as a key mechanism for enforcing timely patching across federal agencies.