Google Patches Two Chrome Zero-Days Actively Exploited in the Wild — Skia and V8 Engine Both Affected

CVE-2026-3909 is an out-of-bounds write vulnerability residing in Skia, the open-source 2D graphics library that Chrome uses to render images, text, fonts, and all visual elements across the browser interface and web content. Out-of-bounds write flaws occur when a program writes data beyond the boundaries of allocated memory. In a browser context this type of memory corruption is particularly dangerous — an attacker who can reliably trigger it may be able to corrupt adjacent memory regions, crash the browser, or gain arbitrary code execution on the victim's machine. CVE-2026-3910 is an inappropriate implementation vulnerability in V8, Chrome's high-performance JavaScript and WebAssembly engine. V8 processes JavaScript delivered by every website you visit, making it a high-value target because it is continuously fed attacker-controlled input during normal browsing. Implementation flaws in JavaScript engines frequently allow attackers to bypass sandbox constraints, manipulate memory during script execution, or achieve remote code execution through carefully constructed scripts embedded in malicious pages. Google has confirmed that exploits for both flaws exist and are being used in active attacks, but consistent with its standard disclosure policy, the company has withheld specific details about the attack campaigns, targets, and threat actors involved to prevent additional exploitation while the patch rolls out.

Both vulnerabilities require only that a victim visit a malicious or compromised webpage — no file download, no plugin, no additional step. This makes them viable as drive-by exploitation tools, where attackers compromise legitimate websites or run malicious advertising and direct victims toward pages delivering the exploit silently in the background. The broader context makes this update particularly urgent: Chrome is the world's most widely used browser, running on an estimated 3.4 billion devices. A zero-day in Chrome's rendering engine or JavaScript runtime represents one of the highest-leverage attack surfaces available to threat actors at any given time. In 2025, Google patched a total of eight actively exploited Chrome zero-days. Three have already been confirmed exploited in the wild in the first ten weeks of 2026, suggesting continued aggressive targeting of the browser by sophisticated actors.