Google Issues Urgent Update for Chrome Zero-Day Vulnerabilities

Google has released an emergency update for its Chrome browser to address two high-severity zero-day vulnerabilities, CVE-2026-3909 and CVE-2026-3910, which are currently being exploited in the wild. These vulnerabilities affect approximately 3.5 billion Chrome users globally. CVE-2026-3909 is an out-of-bounds write vulnerability in the Skia graphics library, which could allow attackers to crash the browser or execute malicious code. CVE-2026-3910 involves an inappropriate implementation in the V8 JavaScript and WebAssembly engine, potentially enabling script execution on web pages.

Google Fixes Two Actively Exploited Chrome Zero-Day FlawsGoogle Issues Alert to 3.5 Billion Chrome Users After Confirming Zero-Day AttacksActively exploited Google Chrome zero-days receive emergency fixes

This update follows a similar vulnerability, CVE-2026-2441, which was patched in February 2026. Google has acknowledged that these vulnerabilities represent the second and third actively exploited zero-days in 2026, highlighting a concerning trend in browser security. The rapid response from Google, issuing patches within days of discovering the vulnerabilities, underscores the urgency of the situation.

Google Issues Alert to 3.5 Billion Chrome Users After Confirming Zero-Day AttacksGoogle Fixes Two Actively Exploited Chrome Zero-Day FlawsActively exploited Google Chrome zero-days receive emergency fixes

Google has confirmed the existence of exploits for both vulnerabilities and has opted to restrict detailed information about the bugs until a majority of users have updated their browsers. This precaution aims to prevent further exploitation while the patches are being rolled out. The company stated, "Access to bug details and links may be kept restricted until a majority of users are updated with a fix."

Actively exploited Google Chrome zero-days receive emergency fixes

While Google has acted swiftly to address these vulnerabilities, some cybersecurity experts have raised concerns about the frequency of zero-day vulnerabilities affecting Chrome. The need for urgent updates so soon after previous patches indicates potential weaknesses in the browser's security architecture. Critics argue that users should be more aware of the risks associated with using widely adopted software like Chrome, which is a frequent target for attackers.

Google Issues Alert to 3.5 Billion Chrome Users After Confirming Zero-Day AttacksGoogle Fixes Two Actively Exploited Chrome Zero-Day FlawsActively exploited Google Chrome zero-days receive emergency fixes

Users are encouraged to update their Chrome browsers immediately to mitigate the risks associated with these vulnerabilities. The update is available for Windows, macOS, and Linux users via the Stable Desktop channel. Users can manually check for updates by navigating to Settings > Help > About Google Chrome, which will prompt the browser to install the latest version.

Google Fixes Two Actively Exploited Chrome Zero-Day FlawsActively exploited Google Chrome zero-days receive emergency fixesGoogle Issues Alert to 3.5 Billion Chrome Users After Confirming Zero-Day Attacks

As Google continues to roll out the patches, it may take several days for all users to receive the update. The company has committed to monitoring the situation closely and will provide further updates as necessary. In the meantime, users are advised to enable automatic updates to ensure they are protected against potential exploits.

Google Issues Alert to 3.5 Billion Chrome Users After Confirming Zero-Day Attacks

• “Google is aware that exploits for both CVE-2026-3909 & CVE-2026-3910 exist in the wild,” — Google Security Advisory

Google Fixes Two Actively Exploited Chrome Zero-Day Flaws

• “Access to bug details and links may be kept restricted until a majority of users are updated with a fix.” — Google Security Advisory

Actively exploited Google Chrome zero-days receive emergency fixes