Google Patches Two Exploited Chrome Zero-Days

Google released emergency security updates for its Chrome browser on Thursday to address two high-severity zero-day vulnerabilities that are actively being exploited by attackers. The flaws, tracked as CVE-2026-3909 and CVE-2026-3910, affect the browser's core components and could allow remote attackers to crash systems or execute malicious code through crafted web pages. The patches are included in Chrome version 146.0.7680.76 for Windows and macOS, 146.0.7680.75 for Linux, and 146.0.7680.115 for Android, with updates rolling out over the coming days and weeks.

The first vulnerability, CVE-2026-3909, involves an out-of-bounds write in Skia, Chrome's open-source graphics library used for rendering web content and user interfaces. This flaw enables attackers to write data beyond allocated memory boundaries, potentially leading to data corruption, browser crashes, or arbitrary code execution. The second, CVE-2026-3910, stems from an inappropriate implementation in the V8 JavaScript and WebAssembly engine, allowing malicious web content to manipulate browser behavior or trigger memory errors that could result in code execution within the browser's sandbox.