Critical Chrome Zero‑Day Flaws (CVE‑2026‑3909 & CVE‑2026‑3910) Enable Remote Code Execution – Google Issues Emergency Patches
What It Is – Google released emergency updates for Chrome to fix two high‑severity zero‑day vulnerabilities: an out‑of‑bounds write in the Skia graphics library (CVE‑2026‑3909, CVSS 8.8) and a memory‑corruption bug in the V8 JavaScript engine. Both have been observed exploited in the wild, allowing remote code execution on affected browsers.
Exploitability – Active exploitation confirmed; proof‑of‑concept code has been shared publicly. The CVSS 8.8 rating reflects the ease of remote exploitation and the potential for full system compromise.
Affected Products – Google Chrome (desktop, Android, and Chrome‑OS builds) prior to version 129.0.XXXX.
TPRM Impact – Enterprises that rely on Chrome for SaaS access, internal portals, or as a component of a broader web‑application supply chain face a heightened risk of credential theft, data exfiltration, and lateral movement. Unpatched browsers can become an entry point for supply‑chain attacks targeting downstream customers.
Recommended Actions –
- Deploy the latest Chrome update (v129.0 or later) across all endpoints immediately.
- Enforce automatic browser updates via enterprise policy.
- Enable Chrome’s built‑in “Site Isolation” and “Enterprise Safe Browsing” features.
- Conduct threat‑hunt queries for known exploitation indicators (e.g., suspicious HTML/JS payloads).
- Review browser‑based application security controls and consider sandboxing or remote‑browser isolation for high‑risk users.
Source: The Hacker News