---
id: "CVE-2026-3910"
kind: "vulnerability"
aliases: ["CVE-2026-3910"]
title: "Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute\u2026"
severity: "high"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Google Chromium V8", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "google chrome", "fixed": ["146.0.7680.75"], "affected": "< 146.0.7680.75", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browsers", "chromium", "exploited", "google-chrome", "microsoft-edge", "opera", "other"]
not_affected_if: ["no-chromium-browser-installed"]
published_at: "2026-03-13T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3910", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3910", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute…

A memory-bounds bug in V8, the JavaScript engine inside Chromium browsers, lets a remote attacker run code inside the browser sandbox by getting a victim to load a crafted HTML page. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Google Chromium V8 affected ? fixed ?
- vendor:google chrome affected < 146.0.7680.75 fixed 146.0.7680.75

## How to check

Open the browser's about page (chrome://version or edge://version) and compare the version to the vendor's fixed release.

## Fix

Update Google Chrome, Microsoft Edge, Opera and other Chromium browsers to the latest stable release that includes the vendor fix.
If the browser cannot be updated, follow CISA guidance and stop using it for untrusted content.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-3910
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-3910

## From the sources

Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_