CVE-2026-3910
Published: 13 March 2026
Summary
CVE-2026-3910 is a high-severity Code Injection (CWE-94) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 21.8% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-3910 is a high-severity vulnerability stemming from an inappropriate implementation in the V8 JavaScript engine within Google Chrome versions prior to 146.0.7680.75. It allows a remote attacker to execute arbitrary code inside the browser's sandbox through a crafted HTML page. The issue is tagged with CWE-94 (Code Injection) and CWE-119 (Buffer Overflow) and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting network accessibility, low attack complexity, no required privileges, but user interaction needed, with high impacts on confidentiality, integrity, and availability within unchanged scope.
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or opening a crafted HTML page. No authentication or privileges are required on the attacker's part, though the user must interact by loading the page. Successful exploitation enables arbitrary code execution confined to the sandbox, potentially allowing attackers to steal sensitive data, manipulate browser state, or chain with other flaws for broader compromise.
Mitigation is addressed in the Chrome stable channel update to version 146.0.7680.75 or later, as detailed in the Chromium release blog and associated issue tracker. Security practitioners should prioritize updating affected Chrome installations and advise users against visiting untrusted sites.
This vulnerability appears in the CISA Known Exploited Vulnerabilities Catalog, indicating real-world exploitation is occurring or imminent, underscoring the need for immediate patching.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11736
Vulnerability details
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
- KEV Date Added
- See CISA KEV catalog
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote code execution via a crafted HTML page on a malicious website, directly mapping to Drive-by Compromise (T1189) and Exploitation for Client Execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of flaws like the V8 JavaScript engine vulnerability in Chrome prior to 146.0.7680.75, preventing arbitrary code execution via crafted HTML.
Mandates vulnerability scanning to identify systems running vulnerable Chrome versions affected by CVE-2026-3910 before exploitation occurs.
Ensures organizations receive and act on security advisories for known exploited vulnerabilities like CVE-2026-3910 in the CISA KEV catalog.