What is the CVSS score of CVE-2026-3910?

CVE-2026-3910 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-3910?

Yes, a public proof-of-concept exploit is available for CVE-2026-3910. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-3910?

Within 24 hours: Communicate patch availability to all users and enable auto-update enforcement in Chrome policies. Within 7 days: Verify 95%+ of Chrome installations are updated to version 146.0.7680.75 or later through endpoint management tools and conduct spot audits on critical workstations. Within 30 days: Complete 100% patching across the organization, review browser isolation or sandboxing controls for high-risk users, and assess whether additional endpoint detection and response (EDR) tuning is warranted to detect exploitation attempts.

Chrome CVE-2026-3910

HIGH

Buffer Overflow (CWE-119)

2026-03-13 chrome-cve-admin@google.com

RCE Buffer Overflow Chrome Google Red Hat Suse

8.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious HTML page
Delivery

Deliver to victim via link or embed
Exploit

V8 parser processes crafted input
Execution

Memory corruption in V8 engine
Impact

Execute arbitrary code in Chrome sandbox

Vulnerability Assessment

Weakness	CWE CWE-119 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	User must visit attacker-controlled or compromised website with crafted HTML. Requires Chrome prior to version 146.0.7680.75 with default V8 configuration. No authentication or special privileges needed.
Impact	CVSS 8.8 (High). KEV-listed — actively exploited. Public PoC available. Patch available in Chrome 146.0.7680.75. V8 bugs are the most common Chrome exploitation vector. Affects all Chromium browsers. Drive-by exploitation.
Exploit ScenarioDerived	An attacker embeds crafted JavaScript in a webpage that triggers the V8 memory corruption when the JIT compiler processes it. The exploit gains code execution within the renderer sandbox. This can be chained with a sandbox escape for full system compromise, or used standalone to steal sensitive data from the renderer process (cookies, passwords from autofill, data from other same-site pages).

Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 13, 2026

Chrome's V8 JavaScript engine contains an inappropriate implementation (CVE-2026-3910, CVSS 8.8) that allows remote attackers to execute arbitrary code within the browser sandbox via crafted HTML pages. KEV-listed with public PoC, this V8 vulnerability affects all Chromium-based browsers and enables drive-by exploitation through any web page containing malicious JavaScript.

Earlier versions of this analysis (1)

v1 Mar 13, 2026 - 20:00 CVSS 8.8

Chrome's V8 JavaScript engine contains an implementation flaw (CWE-119) that leads to memory corruption during JavaScript execution, enabling arbitrary code execution within the renderer sandbox.

RemediationAI

Update Chrome to 146.0.7680.75+ immediately. Update all Chromium-based browsers. Consider disabling JIT compilation via --js-flags=--jitless for high-security environments (performance trade-off).

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

V8 is Chrome's high-performance JavaScript and WebAssembly engine. The implementation flaw creates a condition where V8's JIT compiler or runtime mishandles specific JavaScript constructs, leading to memory corruption. V8 vulnerabilities are particularly valuable because JavaScript execution is the most common attack surface in browsers — every webpage runs JavaScript, and V8 processes it all.

Know when Chrome gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD HIGH

SUSE HIGH

Red Hat 8.8 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Mar 13, 2026 - 20:24 cisa

CISA KEV

PoC Detected

Mar 13, 2026 - 20:24 vuln.today

Public exploit code

Patch released

Mar 13, 2026 - 20:24 nvd

Patch available

CVE Published

Mar 13, 2026 - 19:55 nvd

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Executive ViewAI

Why It Matters

CVE-2026-3910 is a high-severity vulnerability in Google Chrome that enables attackers to execute malicious code on user browsers through weaponized webpages. This vulnerability is actively exploited in the wild and poses a direct risk to employee productivity, data security, and potential lateral movement into corporate networks, particularly for users accessing sensitive systems or financial applications.

Business Impact: High

Compensating Controls

Apply vendor patch. If immediate patching is delayed: restrict browsing to allowlisted domains using proxy/firewall rules, deploy web content isolation technology for high-risk users, disable JavaScript in browser policies where operationally feasible, and heighten EDR alerting for suspicious child process creation from browser engines.

Threat Intelligence Overview

Threat Score

4.8/10

Composite threat intelligence

EPSS Score

0.1%

Top 77% exploitable

Threat Intel

1 source

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

NVD

CVE.org

CISA KEV

EPSS NCSC-NL Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV Yes

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

119

Low Medium High Critical

KEV: +50

EPSS: 0

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: +5

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.