One allows a remote attacker to execute arbitrary code inside a sandbox, the other could result in loss of sensitive information.

CSO Online offers insights into cybersecurity, risk management, and IT leadership, providing articles, reports, and expert analysis to help security professionals navigate the evolving threat landscape and protect their organizations from cyber attacks. By exploring CSO Online's curated content, CISOs, security managers, and IT executives can learn about threat intelligence, security frameworks, and incident response strategies for building resilient cybersecurity programs. Whether you're defending against ransomware, phishing attacks, or insider threats, CSO Online offers resources to strengthen your security posture and safeguard your digital assets.

CSO Online

Google has issued emergency patches for two actively exploited high-severity Chrome zero-day vulnerabilities (CVE-2026-3909 and CVE-2026-3910). The first allows remote code execution inside a sandbox via a flaw in Chrome's V8 JavaScript/WebAssembly engine; the second enables out-of-bounds memory access through a bug in Chrome's Skia graphics library, potentially exposing sensitive data. Browsers before version 146.0.7680.75 are affected. Security experts urge IT teams to patch immediately, enable automatic updates across enterprise endpoints, and consider browser isolation technologies. All Chromium-based browsers including Edge are also affected.

Google warns of two actively exploited Chrome zero days