CVE-2026-3910

Think of your browser sandbox like a locked room meant to keep malicious actions from escaping. This bug is a way for a crafted web page to slip malicious instructions into that room and run attacker code. If it hits, it can turn a normal browsing session into a foothold for stealing data or doing further damage.

This matters if your small business computers use Google Chrome (and Microsoft Edge) on a version older than 146.0.7680.75. Because the attacker only needs to send a victim a malicious HTML page, you don’t need special logins or special admin access for the initial step—users just have to open the page. It is a risk on any device where the browser version is still unpatched, and it’s reachable through normal web browsing.

This is RED because it is included in CISA’s KEV list, meaning it has reached the level of confirmed real-world risk that warrants a set remediation deadline. Even without a public exploit drop, the bug is reachable from the network and triggered by a crafted web page, so normal browsing can expose users if browsers aren’t updated by the due date.

Confirm exposure

• Inventory endpoints where Google Chrome (and Microsoft Edge) are used.
• For each device, record the browser version. Your goal is to identify whether it is prior to 146.0.7680.75 (for Chrome), since the fix is available starting at that version.

Upgrade / patch

• Upgrade Google Chrome to 146.0.7680.75 or later.
• On Debian, openSUSE Leap, Astra Linux, and other Linux desktops: ensure the system packages providing Chrome/Edge include the fix (update the browser package via your normal distro update mechanism).
• On Windows/macOS: upgrade Chrome using your organization’s standard browser update method.

Temporary workaround (if patching is delayed)

• Follow the vendor’s mitigation/secure configuration guidance referenced in the browser’s security update materials.
• Reduce exposure by tightening web access and restricting navigation to untrusted sites until the upgrade is complete.
• Prioritize patching for users who browse the most broadly (general web users, frontline teams), since user interaction is required (opening the crafted page).

Timeline / due date

• CISA KEV remediation due date: 2026-03-27.

What to monitor after updating

• Confirm browsers show the fixed version.
• Watch for unusual browser-related activity (unexpected downloads, new extensions, or suspicious network connections) as part of routine security monitoring.

What the vulnerability allows

• Impact: Arbitrary code execution by a remote attacker that lands in the browser context and runs inside the browser sandbox, described as “execute arbitrary code inside the browser sandbox.”
• Trigger: A crafted HTML page delivered over the network, with no authentication required.
• User interaction: Yes (a victim must open/visit the crafted page).

Product and versions

• Google Chrome is vulnerable prior to 146.0.7680.75; fix is available at 146.0.7680.75.
• Affected ecosystem in this report includes Debian, red os, astra linux, openSUSE Leap, Microsoft Edge, and Google Chrome.

Exploitation status and maturity

• CISA KEV: Yes, added 2026-03-13 with remediation due 2026-03-27 (this drives the RED urgency).
• Public exploit code: No public exploit is on record in the provided findings.
• Press/exploitation reports: The provided articles do not clearly claim active in-the-wild exploitation for CVE-2026-3910; they primarily discuss other Chrome zero-days and mention this CVE in lists. Exploitation claims in the provided reporting are explicitly attributed to CVE-2026-85046, not this CVE.
• EPSS: Provided as a prediction and not used to override KEV-backed urgency.

Weakness category

• CWE-94 (code injection) and CWE-119 (improper restriction/handling leading to code execution) are listed as the weakness types for this issue.