CVE-2026-3910

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Mar 13, 2026
Last modified
Jun 17, 2026
Added to CISA KEV
Mar 13, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-391035.5Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of servicCVE-2026-391076.3A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails to properly sanitizCVE-2026-391099.4SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the username parameter CVE-2026-39112.7A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. ByCVE-2026-391108.2SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the contactno parameter of CVE-2026-391117.5SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the CVE-2026-391125.4Cross Site Scripting vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the visname parameteCVE-2026-391134.0Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f10695CVE-2026-391179.8An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitraryCVE-2026-391188.4An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke CVE-2026-39128.7Injection vulnerabilities due to validation/sanitisation of user-supplied input in ActiveMatrix BusinessWorks and Enterprise Administrator aCVE-2026-39138.8Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a
CVE-2026-3910: High severity, CVSS 8.8 | Vulnix