
Chrome Gets Urgent Patch for Two In-The-Wild Zero-Days
Google released emergency Chrome updates to fix two high-severity zero-days actively exploited in the wild: CVE-2026-3909 (an out-of-bounds write in Skia) and CVE-2026-3910 (an issue in the V8 engine). Patches rolled out to Windows (146.0.7680.75), macOS (146.0.7680.76), and Linux (146.0.7680.75) in the Stable channel, with automatic updates available. Google says exploits exist in the wild but will keep bug details restricted until most users are updated. These are the second and third Chrome zero-days exploited in 2026; Google previously fixed CVE-2026-2441 in February, and it paid over $17 million to 747 researchers through its VRP in 2025.


