Trending Now - Google Addresses Two Active Chrome Vulnerabilities With Urgent Update
WHO:
U.S. Cybersecurity and Infrastructure Security Agency (CISA)
WHAT:
Google stated, "Access to bug details and links may be kept restricted until a majority of users are updated with a fix."
Google has patched a total of three actively weaponized Chrome zero-days since the start of 2026, with the first being CVE-2026-2441, addressed in mid-February 2026.
Google revealed that it paid over $17 million to 747 security researchers through its Vulnerability Reward Program (VRP) in 2025.
Google released security updates for Chrome to address two high-severity vulnerabilities.
The vulnerabilities are identified as CVE-2026-3909 and CVE-2026-3910.
CVE-2026-3909 has a CVSS score of 8.8 and is an out-of-bounds write vulnerability in the Skia 2D graphics library.
CVE-2026-3910 has a CVSS score of 8.8 and is an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine.
Google noted that exploits for both vulnerabilities exist in the wild.
Google has patched a total of three actively weaponized Chrome zero-days since the start of 2026.
Google paid over $17 million to 747 security researchers through its Vulnerability Reward Program (VRP) in 2025.
WHERE:
Chrome web browser
Affected systems include Windows, macOS, and Linux.
WHEN:
Security updates were released on March 12, 2026.
Both vulnerabilities were discovered and reported by Google on March 10, 2026.
CISA added the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on March 13, 2026.
Federal Civilian Executive Branch (FCEB) agencies are required to apply the fixes by March 27, 2026.
The first zero-day vulnerability (CVE-2026-2441) was addressed in mid-February 2026.
WHY:
The vulnerabilities were exploited in the wild, prompting Google to release emergency security updates.
HOW:
Users can check for updates manually through Chrome's settings menu and will need to restart the browser to complete installation.
Users are advised to update their Chrome browser to versions 146.0.7680.75/76 for Windows and macOS, and 146.0.7680.75 for Linux.
Users can check for updates by navigating to More > Help > About Google Chrome and selecting Relaunch.
(UPDATED March 14, 2026 11:04 UTC)
Google has announced that access to bug details and links may be restricted until most users have received a fix for the recent vulnerabilities. Since the beginning of 2026, the tech giant has patched three actively weaponized Chrome zero-days, with the first one, CVE-2026-2441, being addressed in mid-February. Additionally, Google revealed that it paid over $17 million to 747 security researchers through its Vulnerability Reward Program in 2025, and users are encouraged to check for updates manually in Chrome's settings and restart the browser to complete the installation.
--
(UPDATED March 13, 2026 23:10 UTC)
Google has released important security updates for Chrome to address two high-severity vulnerabilities, CVE-2026-3909 and CVE-2026-3910, both of which have a CVSS score of 8.8 and were discovered on March 10, 2026. These vulnerabilities, which affect Windows, macOS, and Linux systems, have already been exploited in the wild, prompting the urgent updates that were made available on March 12, 2026. Users are encouraged to update their Chrome browsers to the latest versions and can do so by navigating to More, then Help, and selecting About Google Chrome to check for updates.