Active Exploits of Two High‑Severity Chrome Flaws (CVE‑2026‑3909 & CVE‑2026‑3910) Threaten Enterprise Browsing
What It Is – Google disclosed two high‑severity Chrome vulnerabilities (CVE‑2026‑3909, CVE‑2026‑3910) that are already being exploited in the wild. Both receive a CVSS 8.8 rating and allow remote code execution via a malicious HTML page.
Exploitability – Active exploits observed; proof‑of‑concept code has not been publicly released, but Google confirms exploitation in the wild.
Affected Products – Google Chrome 146.0.7680.75/76 (Windows, macOS, Linux) and any downstream products that embed Chrome (e.g., Chrome WebView, Electron apps).
TPRM Impact – A compromised browser can be a foothold for attackers to move laterally across a vendor’s network, exfiltrate data, or inject malicious code into SaaS platforms that rely on embedded Chromium.
Recommended Actions –
- Deploy Chrome 146.0.7680.75+ immediately via automated patching.
- Enforce mandatory browser updates for all employees and third‑party users.
- Deploy web‑content filtering or sandboxing for untrusted sites.
- Monitor endpoint telemetry for exploitation indicators (e.g., abnormal V8/Skia crashes).
- Review any internal applications that bundle Chrome (WebView, Electron) and update their runtimes.
Source: SecurityAffairs – Google fixed two new actively exploited flaws in the Chrome browser