Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8
Summary: Google released Chrome security updates on Thursday for two high-severity vulnerabilities, CVE-2026-3909 and CVE-2026-3910, both discovered and reported by Google on March 10, 2026, and both confirmed exploited in the wild. The fixes arrive less than a month after a Chrome CSS use-after-free bug (CVE-2026-2441, CVSS 8.8) was patched as a zero-day, bringing Google to three actively weaponized Chrome zero-days patched since the start of the year.
What's compelling: CISA added both flaws to its KEV catalog on March 13, 2026, giving Federal Civilian Executive Branch agencies until March 27, 2026 to apply the fixes - a two-week window that assumes every affected endpoint, including Chromium-based browsers like Edge, Brave, Opera and Vivaldi, gets patched on the same clock.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-2441CVE-2026-3909CVE-2026-3910
- Related