KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2026-3910
8.8
3-Day Required
PoC Available
KEV
Active Exploitation
Details
VulnerabilityGoogle Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
VendorGoogle
ProductChromium V8
Date added2026-03-13
Due date2026-03-27
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-119 CWE-94
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Descriptions
KEV: Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
NVD: Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Compliance SSVC + BOD 26-04
Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required
Research metadata
Last researched2026-08-28 10:53 UTC
Wall time120.0s
Searches4
Component defaultunknown
Sources
https://osv.dev/vulnerability/CVE-2026-3910
https://nvd.nist.gov/vuln/detail/CVE-2026-3910
https://sensibleclown.com/posts/CVE-2026-3909-CVE-2026-3910-Technical-Deep-Dive-into-Chrome-Dual-Zero-Day-Exploit-Chain/
https://gist.github.com/alon710/c553629e191a221bef38ca6baeb7b93a
https://github.com/anansi2safe/CVE-2026-3909-and-3910-PoC
https://socprime.com/blog/cve-2026-3910-vulnerability/
https://github.com/Nirav9369/chrome-zero-day-analysis
https://github.com/mwlik/v8-ndays/tree/main/CVE-2026-3910
https://www.sentinelone.com/vulnerability-database/cve-2026-3910/
https://rdintel.com/cve/CVE-2026-3910
https://vulnsocial.com/cve/CVE-2026-3910
https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html
https://cvereports.com/reports/CVE-2026-3910
https://exploit-intel.com/blog/posts/cve-2026-3910-v8-maglev-autonomous-exploit/
https://nvd.nist.gov/vuln/detail/CVE-2026-3910
https://sensibleclown.com/posts/CVE-2026-3909-CVE-2026-3910-Technical-Deep-Dive-into-Chrome-Dual-Zero-Day-Exploit-Chain/
https://gist.github.com/alon710/c553629e191a221bef38ca6baeb7b93a
https://github.com/anansi2safe/CVE-2026-3909-and-3910-PoC
https://socprime.com/blog/cve-2026-3910-vulnerability/
https://github.com/Nirav9369/chrome-zero-day-analysis
https://github.com/mwlik/v8-ndays/tree/main/CVE-2026-3910
https://www.sentinelone.com/vulnerability-database/cve-2026-3910/
https://rdintel.com/cve/CVE-2026-3910
https://vulnsocial.com/cve/CVE-2026-3910
https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html
https://cvereports.com/reports/CVE-2026-3910
https://exploit-intel.com/blog/posts/cve-2026-3910-v8-maglev-autonomous-exploit/
Hunting hypothesis agent
Hunt Chrome crash reports for V8 Maglev type confusion where CanElideWriteBarrier lets a HeapNumber land in a PACKED_SMI_ELEMENTS array without a write barrier — PoC (mwlik/v8-ndays) builds addrof via charCodeAt OOB, escapes via JSPI UAF.
Research details
ComponentV8 JavaScript engine (Maglev JIT compiler)
PreconditionsUser must visit a crafted HTML page in a vulnerable Chrome/Chromium browser (prior to version 146.0.7680.75); no additional privileges required. The V8 Maglev JIT compiler's CanElideWriteBarrier() function incorrectly eliminates write barriers for Smi representation in Phi edge cases at src/maglev/maglev-graph-builder.cc lines 4457-4463. Combined with elided runtime Smi checks via BuildCheckSmi() which checks StaticTypeIs(kSmi) before examining the elidable flag, the phi can produce a HeapNumber instead of a Smi, which is stored into a PACKED_SMI_ELEMENTS array without a write barrier. This leads to type confusion and memory corruption, enabling arbitrary code execution within the browser sandbox. The vulnerability was discovered by Google TAG and exploited in the wild as part of a two-stage chain with CVE-2026-3909 (Skia OOB write) for full sandbox escape. agent
DeliveryCrafted HTML page containing JavaScript that exploits the V8 Maglev compiler's Phi untagging pass. The exploit triggers a type confusion by forcing CanElideWriteBarrier() to incorrectly eliminate write barriers for Smi representation in Phi edge cases at src/maglev/maglev-graph-builder.cc lines 4457-4463. Combined with elided runtime Smi checks via BuildCheckSmi(), the Phi produces a HeapNumber instead of a Smi, stored into a PACKED_SMI_ELEMENTS array without a write barrier. GC reclaims the HeapNumber while the array still holds the dangling pointer. The exploit then sprays fake objects at the dangling pointer address and builds addrof/OOB primitives, followed by JSPI UAF and fake JumpBuffer ROP for full sandbox escape.
Public PoCyes
PoC URLs
https://exploit-intel.com/blog/posts/cve-2026-3910-v8-maglev-autonomous-exploit/
https://github.com/anansi2safe/CVE-2026-3909-and-3910-PoC
https://rdintel.com/cve/CVE-2026-3910 Third-party repos; verify before use.
https://github.com/anansi2safe/CVE-2026-3909-and-3910-PoC
https://rdintel.com/cve/CVE-2026-3910 Third-party repos; verify before use.
Exploit notesCVSS attack complexity: LOW. EPSS score: 21.9% (95.67th percentile). Exploitation requires user to visit a crafted HTML page; no additional privileges needed. The vulnerability was actively exploited in the wild by state-level actors (Google TAG confirmed). Multiple public PoC repositories exist: mwlik/v8-ndays provides a full exploit chain (exploit.html) that achieves addrof primitive, sandboxed R/W, and sandbox escape via JSPI UAF + fake JumpBuffer ROP; the exploit phases are: (1) trigger Maglev Phi type confusion to create dangling HeapNumber pointer, (2) spray fake SeqOneByteString at dangling pointer, (3) charCodeAt OOB scan for victim array sentinel (1.1), (4) forge JSArray with elements pointing to victim's JSArray header, (5) overwrite victim.length for OOB R/W, (6) addrof via charCodeAt scan of FixedDoubleArray, (7) sandboxed R/W via elements pointer redirection, (8) find IsolateData via data_segment_starts, (9) JSPI UAF of StackMemory with fake JumpBuffer for PC/SP control. The chain combines with CVE-2026-3909 (Skia OOB write) for full sandbox escape.
SummaryCVE-2026-3910 is a high-severity (CVSS 8.8) type confusion vulnerability in Google Chrome's V8 JavaScript engine, specifically in the Maglev JIT compiler's CanElideWriteBarrier() function (CWE-94/CWE-119). Incorrect write barrier elimination for Smi representation in Phi edge cases, combined with elided runtime Smi checks, allows a HeapNumber to be stored into a PACKED_SMI_ELEMENTS array without a write barrier, causing memory corruption. This enables arbitrary code execution within the browser sandbox via a crafted HTML page. Actively exploited in the wild by state-level actors (Google TAG) as part of a two-stage chain with CVE-2026-3909 (Skia OOB write) for full sandbox escape. Patched in Chrome 146.0.7680.75 (146.0.7680.76 on Windows/Mac).
Tia coverage
First reported2026-06-09
First exploit report2026-06-09
Exploit report → KEV88 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
google-fixes-actively-exploited-android-zero-day-on-pixel-devicegoogle-patches-5th-chrome-zero-day-of-2026-cve-2026-11645-v8-eng
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.