CISA Alerts Users to Exploited Chrome 0-Day Flaws

The Cybersecurity and Infrastructure Security Agency (CISA) has released an urgent security advisory concerning two highly critical zero-day vulnerabilities currently being actively exploited.

These flaws, which impact Google Chrome and its underlying technologies, have prompted CISA to add both issues to its Known Exploited Vulnerabilities (KEV) catalog. This mandates immediate patching for federal agencies and strongly encourages private organizations to apply the necessary updates promptly.

The Skia Graphics Engine Flaw

The first vulnerability, tracked as CVE-2026-3909, is an out-of-bounds write issue within Google’s Skia graphics library. Skia is a widely deployed open-source 2D rendering engine responsible for displaying text, shapes, and images across numerous platforms.

This flaw enables a remote attacker to trigger unintended memory access by simply tricking a user into visiting a specially crafted HTML page.

The extensive use of Skia extends the vulnerability’s impact significantly beyond Google Chrome. It also represents a major security risk for Chrome OS, Android devices, applications built using the Flutter framework, and other software relying on the Skia engine.

The Chromium V8 JavaScript Flaw

The second vulnerability, identified as CVE-2026-3910, exists within the Chromium V8 JavaScript engine. This fundamental component processes dynamic web content. The flaw involves insufficient restrictions on memory buffer operations.

Similar to the Skia issue, a malicious actor can exploit this weakness by luring a victim to a compromised website. Successful exploitation allows the attacker to execute arbitrary code within the initially restricted sandbox environment.

While confined to the sandbox initially, attackers frequently chain this type of memory corruption vulnerability with other exploits to achieve deeper system compromise. Since V8 underpins the foundational Chromium framework, this flaw affects multiple popular browsers, including Microsoft Edge and Opera.

At present, no cybersecurity researchers have confirmed these specific vulnerabilities are being used in active ransomware campaigns. However, the ability to trigger both flaws merely by visiting a malicious website renders them exceptionally dangerous for both general users and enterprise networks.

Attackers commonly leverage these memory corruption bugs to circumvent modern security defenses.

Recommended Mitigations

CISA has set a strict deadline of March 27, 2026, for federal agencies to address these active threats. To secure their systems, organizations should implement the following measures:

• Update all impacted web browsers, including Google Chrome, Microsoft Edge, and Opera, to their latest patched versions.
• Apply necessary updates for ChromeOS, Android, and Flutter-based applications according to official vendor guidance.
• Follow relevant cloud security best practices, or discontinue use of vulnerable products if official patches are unavailable.
• Educate network users about the risks of clicking unverified links, as these exploits require victims to visit malicious web pages.