Critical Chrome Security Flaws Threaten Billions of Users Worldwide

"Google has released updates to patch two high-severity zero-day vulnerabilities in the Chrome browser that are already being exploited in the wild. The flaws affect critical components responsible for rendering web content and executing JavaScript, potentially allowing attackers to crash the browser or execute malicious code on vulnerable systems."

"Out-of-bounds write vulnerabilities occur when software writes data beyond the boundaries of allocated memory buffers, potentially corrupting adjacent memory and altering normal program execution. Because browsers continuously process complex content from untrusted sources, including websites, images, and embedded media, an attacker could potentially craft malicious web content that triggers the vulnerability."

"In more advanced attack chains, memory corruption bugs like this can also be leveraged to escape browser sandbox protections and gain deeper access to the underlying system."

Google released security updates addressing two high-severity zero-day vulnerabilities in Chrome that are currently being exploited in the wild. CVE-2026-3909 is an out-of-bounds write flaw in Skia, Chrome's graphics library used for rendering web content and UI elements. This vulnerability allows attackers to craft malicious HTML pages that trigger memory corruption, potentially crashing the browser or enabling arbitrary code execution. CVE-2026-3910 affects Chrome's V8 engine, responsible for executing JavaScript and WebAssembly code. With approximately 3.8 billion Chrome users globally, these actively exploited vulnerabilities pose significant risk until patches are applied. Out-of-bounds memory access vulnerabilities are particularly dangerous because they can corrupt adjacent memory and potentially allow attackers to escape browser sandbox protections.

Read at TechRepublic