CVE-2026-3910

CVE-2026-3910 is a high-severity vulnerability stemming from an inappropriate implementation in the V8 JavaScript engine within Google Chrome versions prior to 146.0.7680.75. It allows a remote attacker to execute arbitrary code inside the browser's sandbox through a crafted HTML page. The issue is tagged with CWE-94 (Code Injection) and CWE-119 (Buffer Overflow) and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting network accessibility, low attack complexity, no required privileges, but user interaction needed, with high impacts on confidentiality, integrity, and availability within unchanged scope.

A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or opening a crafted HTML page. No authentication or privileges are required on the attacker's part, though the user must interact by loading the page. Successful exploitation enables arbitrary code execution confined to the sandbox, potentially allowing attackers to steal sensitive data, manipulate browser state, or chain with other flaws for broader compromise.

Mitigation is addressed in the Chrome stable channel update to version 146.0.7680.75 or later, as detailed in the Chromium release blog and associated issue tracker. Security practitioners should prioritize updating affected Chrome installations and advise users against visiting untrusted sites.

This vulnerability appears in the CISA Known Exploited Vulnerabilities Catalog, indicating real-world exploitation is occurring or imminent, underscoring the need for immediate patching.