Actively exploited
Listed in CISA’s Known Exploited Vulnerabilities catalog since March 13, 2026.
CVE-2026-3910
Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
Added to KEV March 13, 2026
Alert details
- Source feed
- CISA KEV
- CVE ID
- CVE-2026-3910
- CWE
- CWE-119
- Affected products
- Chromium V8 · Google Chromium V8 · Google
What happened
Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
What it means for your business
Google Chromium V8 is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-3910). Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA remediation due date: 2026-03-27. If you need help checking exposure, call (864) 335-9223.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date: March 27, 2026
Sources
Related briefs
Google Chromium V8 Out of Bounds Write Vulnerability
Google Chromium V8 is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-87491). Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA remediation due date: 2026-09-23. If you need help checking exposure, call (864) 335-9223.
Google Pixel Improper Authorization Vulnerability
Google Pixel is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-58704). Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. CISA remediation due date: 2026-09-19. If you need help checking exposure, call (864) 335-9223.
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-88779). Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. CISA remediation due date: 2026-10-07. If you need help checking exposure, call (864) 335-9223.
Heap buffer overflow in ANGLE in Microsoft Edge vulnerability
Heap buffer overflow in ANGLE in Microsoft Edge vulnerability (CVE-2025-10502) was added to Microsoft’s security update guidance. Information published. If you need help checking exposure, call (864) 335-9223.
Need help patching?
PremierePC monitors KEV alerts for managed clients and helps teams prioritize remediation before attackers do.