This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Google Chrome fixes 2 actively exploited vulnerabilities

Google fixes 2 high-severity, actively exploited vulnerabilities in the Google Chrome browser and other browsers based on the Chromium engine. The latest fix has been released for Windows/macOS (version 146.0.7680.80) and Linux (146.0.7680.80) [1][2]. The latest fix for the Microsoft Edge browser has been released in version 146.0.3856.62 [3].

Google Chrome - out-of-bounds write, RCE (CVE-2026-3909)
CVSS 8.8 (High)

Allows an unauthenticated remote attacker to write out of bounds of allocated memory without authorization and potentially execute code using a specially crafted HTML page [1][4]. The vulnerability is already being actively exploited [1][5].

The vulnerability is present in product:

  • Google Chrome; <146.0.7680.80;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 13. 3. 2026.

Google Chrome - RCE (CVE-2026-3910)
CVSS 8.8 (High)

Allows an unauthenticated remote attacker to execute code within the sandbox using a specially crafted HTML page [2][6]. The vulnerability is already being actively exploited [2][7].

The vulnerability is present in product:

  • Google Chrome; <146.0.7680.75;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-3910 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 12. 3. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 17. 3. 2026.

CESNET, z.s.p.o. Logo