{"id":"CVE-2026-3910","kind":"vulnerability","aliases":["CVE-2026-3910"],"related":[],"title":"Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute…","description":"Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"A memory-bounds bug in V8, the JavaScript engine inside Chromium browsers, lets a remote attacker run code inside the browser sandbox by getting a victim to load a crafted HTML page. CISA lists it as actively exploited in the wild.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-03-13T00:00:00+00:00","products":[{"name":"Google Chromium V8","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"google chrome","fixed":["146.0.7680.75"],"affected":"< 146.0.7680.75","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browsers","chromium","exploited","google-chrome","microsoft-edge","opera","other"],"not_affected_if":["no-chromium-browser-installed"],"how_to_check":"Open the browser's about page (chrome://version or edge://version) and compare the version to the vendor's fixed release.","fix":"Update Google Chrome, Microsoft Edge, Opera and other Chromium browsers to the latest stable release that includes the vendor fix.\nIf the browser cannot be updated, follow CISA guidance and stop using it for untrusted content.","status":"open","published_at":"2026-03-13T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:39:08+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T20:39:08Z","model":"claude-haiku-5-5","output":{"fix":"Update Google Chrome, Microsoft Edge, Opera and other Chromium browsers to the latest stable release that includes the vendor fix.\nIf the browser cannot be updated, follow CISA guidance and stop using it for untrusted content.","reach":"internet","summary":"A memory-bounds bug in V8, the JavaScript engine inside Chromium browsers, lets a remote attacker run code inside the browser sandbox by getting a victim to load a crafted HTML page. CISA lists it as actively exploited in the wild.","category":"other","who_cares":["chromium","google-chrome","microsoft-edge","opera","browsers"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code inside the browser sandbox after the victim loads a crafted page.","analyst_note":"Find the fixed Chromium version from the Chrome Releases blog or the CISA KEV entry, since the sources do not name it.","how_to_check":"Open the browser's about page (chrome://version or edge://version) and compare the version to the vendor's fixed release.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["no-chromium-browser-installed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000486,"input_tokens":2625,"output_tokens":446,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':148C '-2026':18A,21A '-3910':19A,22A '146.0.7680.75':10A '22':147C 'action':138C 'activ':75B 'affect':118C 'allow':11A,99C 'appli':139C 'applic':145C 'arbitrari':105C 'attack':14A,54B,102C 'bod':146C 'bound':41B,91C 'browser':28B,50B,59B,121C 'buffer':95C 'bug':42B 'chrome':7A,27A,33B,131C 'chromium':24A,29B,49B,81C,124C 'cisa':71B,136C 'cloud':151C 'code':56B,106C 'contain':83C 'could':98C,117C 'craft':68B,112C 'cve':17A,20A 'discontinu':154C 'edg':36B,133C 'engin':47B 'execut':16A,104C 'exploit':30B,76B 'follow':144C 'get':62B 'googl':6A,32B,80C,130C 'google':23A,26A 'google-chrom':31B 'guidanc':149C 'html':69B,113C 'implement':2A 'improp':85C 'inappropri':1A 'includ':125C 'insid':48B,57B,107C 'instruct':143C 'javascript':46B 'let':51B 'limit':128C 'list':72B 'load':66B 'memori':40B,94C 'memory-bound':39B 'microsoft':35B,132C 'microsoft-edg':34B 'mitig':140C,160C 'multipl':119C 'oper':88C 'opera':37B,135C 'page':70B,114C 'per':141C 'prior':8A 'product':158C 'remot':13A,53B,101C 'requir':137C 'restrict':86C 'run':55B 'sandbox':60B,109C 'servic':152C 'unavail':162C 'use':155C 'util':123C 'v8':4A,25A,44B,82C 'vendor':142C 'via':110C 'victim':64B 'vulner':96C,116C 'web':120C 'wild':79B 'within':89C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-03-13T00:00:00+00:00","kev":{"dateAdded":"2026-03-13","dueDate":"2026-03-27","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-3910","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3910","severity":null,"published_at":"2026-03-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-3910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3910","severity":null,"published_at":"2026-03-13T19:55:11+00:00","modified_at":"2026-06-17T10:44:24+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}