Critical Chrome Security Flaws Threaten Billions of Users Worldwide

When nearly 4 billion people use the same browser, a single flaw can echo across the internet. Attackers are already exploiting two of them in Chrome.

Google has released updates to patch two high-severity zero-day vulnerabilities in the Chrome browser that are already being exploited in the wild. The flaws affect critical components responsible for rendering web content and executing JavaScript, potentially allowing attackers to crash the browser or execute malicious code on vulnerable systems.

One of the vulnerabilities, CVE-2026-3909, allows “… a remote attacker to perform out-of-bounds memory access via a crafted HTML page,” CVE.org wrote in its advisory.

Because Chrome is used by roughly 3.8 billion people worldwide, actively exploited vulnerabilities in the browser can potentially put billions of systems at risk until patches are applied.

Inside the Chrome zero-day exploits

The first vulnerability, CVE-2026-3909, is an out-of-bounds write flaw in Skia, the open-source graphics library Chrome uses to render web pages, images, and various user interface elements.

Out-of-bounds write vulnerabilities occur when software writes data beyond the boundaries of allocated memory buffers, potentially corrupting adjacent memory and altering normal program execution.

Because browsers continuously process complex content from untrusted sources, including websites, images, and embedded media, an attacker could potentially craft malicious web content that triggers the vulnerability.

If successfully exploited, the flaw could cause the browser to crash or allow attackers to execute arbitrary code within the browser environment.

In more advanced attack chains, memory corruption bugs like this can also be leveraged to escape browser sandbox protections and gain deeper access to the underlying system.

CVE-2026-3910

The second vulnerability, CVE-2026-3910, affects Chrome’s V8 engine, the component responsible for executing JavaScript and WebAssembly code used by websites and web applications.

The issue was described as an inappropriate implementation vulnerability, indicating that certain internal logic in the engine may not handle specific conditions or inputs correctly. If exploited, the flaw could allow malicious web content to manipulate browser behavior, trigger memory errors, or potentially execute attacker-controlled code.

Google confirmed both vulnerabilities are actively exploited in the wild and has released patches, while limiting technical details about the attacks.

How to reduce browser security risks

Because browsers act as a primary gateway to web applications and external content, they are a common entry point for attackers targeting enterprise environments.

The following measures can help organizations strengthen browser security while improving their ability to detect and respond to potential threats.

• Patch Chrome to the latest version and verify deployment across endpoints using patch management tools.
• Implement browser isolation or sandboxing technologies for high-risk browsing activity to reduce the impact of potential browser exploits.
• Monitor EDR/XDR tools for abnormal browser behavior, suspicious script execution, or unusual crashes that could indicate exploitation attempts.
• Restrict high-risk browsing activity on privileged or administrative systems to reduce exposure to browser-based attacks.
• Enforce least-privilege access and apply application control or exploit-mitigation protections to limit the impact of successful exploitation.
• Control or restrict browser extensions and use network filtering or secure web gateways to block malicious domains and exploit-hosting sites.
• Test incident response plans and use attack-simulation tools for browser-based attack scenarios.

Collectively, these steps help reduce the potential blast radius of browser-based attacks while building greater organizational resilience against exploitation attempts.

Editor’s note: This article originally appeared on our sister website, eSecurityPlanet.