Google Chrome Flaws Added to CISA's Exploited Vulnerabilities List
Basically, two serious flaws in Google Chrome could let hackers attack your computer.
CISA has added two high-severity Google Chrome vulnerabilities to its Known Exploited Vulnerabilities catalog. Millions of users are at risk, as these flaws have already been exploited in the wild. Immediate updates and awareness are crucial to protect against potential attacks.
The Flaw
This week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA?) added two vulnerabilities in Google Chrome to its Known Exploited Vulnerabilities (KEV) catalog. These vulnerabilities, tracked as CVE-2026-3909 and CVE-2026-3910, are classified as high severity, with CVSS? scores of 8.8. They pose significant risks as they have already been exploited in the wild?, meaning hackers are actively using them to compromise systems.
CVE?-2026-3909 is an out-of-bounds write? vulnerability in the Skia 2D graphics library. It allows attackers to corrupt memory by tricking users into opening a specially crafted HTML page?. CVE?-2026-3910, on the other hand, is a flaw in the V8 JavaScript/WebAssembly engine. This vulnerability enables attackers to execute arbitrary code within the browser sandbox?, also through malicious HTML page?s. Both flaws were discovered by Google on March 10, 2026.
What's at Risk
The potential impact of these vulnerabilities is substantial. Since Google Chrome is one of the most widely used web browsers globally, millions of users are at risk. If exploited, attackers could gain unauthorized access to sensitive information or take control of affected systems. This risk is particularly high for organizations that rely on Chrome for daily operations, as the vulnerabilities could lead to data breaches or system compromises.
CISA? has mandated that federal agencies must address these vulnerabilities by March 27, 2026. This directive is part of a broader effort to reduce the risk of known exploited vulnerabilities across government networks. The urgency of this action highlights the critical nature of the flaws and the need for immediate remediation.
Patch Status
In response to these vulnerabilities, Google has released security updates? for Chrome. The updated versions are 146.0.7680.75/76 for Windows and Mac, and 146.0.7680.75 for Linux. Users are encouraged to update their browsers as soon as possible to mitigate the risks associated with these vulnerabilities. The updates will be rolled out gradually, so some users may receive them sooner than others.
It's important to note that while Google has patched these vulnerabilities, the existence of active exploits means that users should remain vigilant. Regularly updating software is crucial in maintaining security, especially for widely used applications like web browsers.
Immediate Actions
For users and organizations, the first step is to ensure that their Google Chrome browser is updated to the latest version. Here are some recommended actions:
- Update Chrome: Check for updates and install the latest version.
- Educate Users: Inform employees about the risks of opening suspicious links or attachments, especially from unknown sources.
- Monitor Systems: Keep an eye on network activity for any unusual behavior that could indicate exploitation attempts.
- Review Security Policies: Ensure that your organization has robust security measures in place to protect against such vulnerabilities.
By taking these steps, users can significantly reduce their risk of falling victim to attacks exploiting these newly identified vulnerabilities.
Security Affairs