13 Mar Google Patches Two Chrome Zero-Days Actively Exploited in the Wild
Google has released emergency security updates for Chrome to address two high-severity zero-day vulnerabilities that are being actively exploited by attackers. Both flaws affect critical browser components and allow remote code execution through specially crafted web pages.
Critical Vulnerabilities Discovered
The security flaws, designated as CVE-2026-3909 and CVE-2026-3910, both carry CVSS scores of 8.8 and were discovered internally by Google’s security team on March 10, 2026. According to Google’s advisory, both vulnerabilities are confirmed to be exploited in the wild, making immediate updates crucial for all Chrome users.
Technical Details
CVE-2026-3909 represents an out-of-bounds write vulnerability in Chrome’s Skia 2D graphics library. This flaw enables remote attackers to perform out-of-bounds memory access via crafted HTML pages, potentially leading to system compromise.
CVE-2026-3910 involves an inappropriate implementation issue in the V8 JavaScript and WebAssembly engine. Attackers can exploit this vulnerability to execute arbitrary code within Chrome’s sandbox through malicious web content.
Immediate Action Required
Chrome users must update their browsers immediately to versions 146.0.7680.75/76 for Windows and macOS, or 146.0.7680.75 for Linux. The update process is straightforward: navigate to Chrome’s menu, select “Help,” then “About Google Chrome,” and click “Relaunch” when prompted.
Growing Zero-Day Threat
This incident marks the third actively exploited Chrome zero-day vulnerability patched by Google since the beginning of 2026. The previous vulnerability, CVE-2026-2441, was a use-after-free bug in Chrome’s CSS component that was also being exploited in the wild.
The rapid succession of zero-day discoveries highlights the evolving threat landscape and the importance of maintaining up-to-date browser security. Organizations and individuals using Chrome for business operations should prioritize these updates to prevent potential data breaches and system compromises.
Impact on Dental Practices
For dental practices relying on web-based practice management systems, patient portal access, and cloud-based imaging solutions, these vulnerabilities pose significant security risks. Compromised browsers could potentially expose patient data, financial information, and system credentials.
Compudent Systems recommends that all dental practices immediately verify Chrome updates across all workstations and implement automated update policies where possible. Additionally, practices should consider reviewing their web security protocols and ensuring staff are aware of the importance of browser security.
Additional Browser Protection
Users of other Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi should also apply security updates as they become available. These browsers often incorporate Chrome’s security fixes, though timing may vary by vendor.
As cyber threats continue to evolve, maintaining current browser versions remains one of the most effective defenses against web-based attacks. Organizations should establish regular update schedules and monitor security advisories to stay protected against emerging threats.