Attackers are using this March 12, 2026 Critical severity

Chrome flaws used in attacks

Flaws in Chrome’s JavaScript engine (V8) and Chrome’s graphics code (Skia) let a booby-trapped web page run code. Google says exploits exist in the wild. Fixed in Chrome 146.0.7680.75.

On a Mac

Chrome and other Chromium browsers, and apps built on Electron or Chromium. Each app carries its own copy, so it stays exposed until that app updates, even when Chrome is current.

The fix

• Chrome 146.0.7680.75
• Electron 39.8.2, 40.8.2, 41.0.3, 42.0.0, 43.0.0, 44.0.0 and 45.0.0

Attacks

In CISA’s catalog of exploited flaws since March 13, 2026.

CVEs

CVE-2026-3909, CVE-2026-3910

Sources

• chromereleases.googleblog.com
• cisa.gov

From the Briefing, updated 17 minutes ago.