CVE-2026-3910: Google Chromium V8 Memory Buffer -- Sandbox RCE via Crafted HTML

Background

Google Chrome and the Chromium browser engine underpin the majority of modern web browsing worldwide — Chrome alone has over 60% browser market share, and Chromium powers Edge, Brave, Opera, and many other browsers. The V8 JavaScript engine is Chrome’s high-performance JavaScript runtime, responsible for executing the JavaScript code that powers modern web applications.

V8 is an extremely complex, performance-critical piece of software written in C++ that employs advanced compilation techniques (JIT compilation, speculative optimisation) to maximise JavaScript execution speed. This complexity, combined with the need to execute untrusted web content at high speed, makes V8 a persistent target for browser security research and exploitation. Browser sandbox escapes via V8 vulnerabilities are among the most valuable vulnerabilities in the exploit market, as they enable drive-by compromise of any user who browses to a malicious webpage. CISA added CVE-2026-3910 to the KEV catalogue on 2026-03-13.

Technical Mechanism

CVE-2026-3910 is an “improper restriction of operations within a memory buffer” — a memory safety vulnerability in V8’s JavaScript engine. Browser memory corruption vulnerabilities typically fall into categories including type confusion, out-of-bounds write, use-after-free, and heap buffer overflow.

In V8’s context, the most common attack path involves:

1. Type confusion: V8’s JIT compiler optimises code based on observed type patterns. If the attacker can confuse V8 about the type of a JavaScript value — for example, making V8 treat a floating-point value as a pointer — they can construct a read/write primitive over arbitrary memory
2. Sandbox exploitation: V8 runs within Chrome’s renderer sandbox. Memory corruption within V8 gives the attacker code execution within the renderer sandbox, but not yet on the host OS
3. Sandbox escape: To achieve full system compromise, a sandbox escape is typically chained (either a separate vulnerability or as part of a multi-bug exploit chain)

The attack is delivered via crafted HTML containing malicious JavaScript:

1. A victim visits a malicious or compromised webpage (via phishing link, watering hole, or ad injection)
2. The page’s JavaScript triggers the V8 memory corruption vulnerability
3. The attacker achieves JavaScript sandbox escape — code execution within the renderer process
4. Depending on whether a sandbox escape is chained, the attacker either has renderer-level RCE or full OS-level RCE

Real-World Exploitation Evidence

CVE-2026-3910 was added to CISA KEV on 2026-03-13, indicating confirmed in-the-wild exploitation at time of or prior to patch release:

• Zero-day exploitation — Chrome/Chromium V8 vulnerabilities are frequently exploited as zero-days before patches are available; state-sponsored groups and commercial exploit vendors invest heavily in these capabilities
• Nation-state spyware — commercial spyware vendors (NSO Group, Intellexa, others) have used Chromium V8 vulnerabilities in their products for remote device compromise without user interaction beyond browser use
• Watering hole and targeted phishing — sophisticated threat actors use browser zero-days in highly targeted campaigns against government, defence, and critical infrastructure targets
• Drive-by download campaigns — less sophisticated actors use patched browser vulnerabilities against users who are slow to update, embedding exploits in malicious advertising or compromised websites

Chrome’s automatic update mechanism significantly limits the exploitation window once a patch is released.

Impact Assessment

CVE-2026-3910 directly affects any user whose Chrome or Chromium-based browser visits a page serving the exploit, without requiring any action beyond normal browsing. Successful exploitation achieves code execution within the browser’s renderer sandbox, and when chained with a sandbox escape, yields full OS-level code execution on the victim’s device. The attacker gains access to the user’s files, credentials stored in the browser, active session cookies, and any secrets accessible to the logged-in user. Because the exploit is deliverable via a single page visit — through phishing links, malicious advertising, or compromised legitimate websites — the required attacker effort per victim is low.

The broader organisational impact depends heavily on the victim population and patching velocity. Browser vulnerabilities affect the widest possible attack surface: virtually every knowledge worker uses a Chromium-based browser, and a single watering-hole or phishing campaign can compromise many users simultaneously. High-value targets such as executives, finance teams, and IT administrators represent the highest-risk group since their accounts typically carry elevated privileges. Chrome’s automatic update mechanism is the most effective mitigation and significantly narrows the exploitation window compared to infrastructure vulnerabilities, but organisations with delayed or restricted update policies face substantially longer exposure periods.

Affected Versions

Chrome updates automatically by default. Users and administrators should verify Chrome is up to date.

Remediation Steps

1. Update Google Chrome immediately to the latest stable version:
   • Chrome self-updates by default; verify via chrome://settings/help
   • Force update deployment via enterprise policy (Google Admin Console or MDM)
2. For enterprise deployments, use Google Admin Console to enforce automatic updates and verify compliance
3. Update all other Chromium-based browsers (Edge, Brave, Opera) to their latest versions
4. Consider enabling Chrome’s Enhanced Safe Browsing protection, which provides additional protection against malicious sites
5. For high-risk users (executives, legal, finance), consider temporarily restricting browsing to known-safe sites until updates are confirmed deployed
6. Deploy a DNS security or web proxy solution that blocks known malicious domains associated with exploit delivery
7. Ensure browser security policies are in place:

   # Chrome Enterprise policy: enforce update
   "AutoUpdateCheckPeriodMinutes": 60

Detection Guidance

Endpoint security telemetry:

• Unusual child processes spawned by the Chrome renderer process (chrome.exe or chrome with --type=renderer)
• Renderer process crashes followed immediately by unusual network connections
• Suspicious outbound connections from Chrome processes to unknown IP addresses

DNS/web proxy monitoring:

• Access to known exploit delivery infrastructure domains
• Downloads of unusual file types from unexpected domains

EDR/MDM:

• Chrome process tree anomalies (renderer spawning system shells)
• Memory allocation patterns consistent with heap spray techniques

SIEM query example (Splunk):

index=endpoint_telemetry sourcetype=sysmon EventCode=1
| where ParentImage like "%chrome.exe%" OR ParentImage like "%msedge.exe%"
| where NOT (Image like "%chrome.exe%" OR Image like "%msedge.exe%" OR Image like "%chrome_crashpad%")
| stats count by ComputerName, Image, CommandLine, ParentImage
| sort -count

Browser management:

• Monitor Chrome version compliance via Google Admin Console or MDM reporting
• Alert on Chrome versions more than 2 major versions behind current stable

Timeline

References

• NVD — CVE-2026-3910
• CISA KEV — CVE-2026-3910
• Google Security Advisory — CVE-2026-3910