Google · Chromium V8
CVE-2026-3910
Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
Cos'è
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CISA: Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Cosa fare
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Scadenza per le agenzie federali USA: 27 marzo 2026
Altre falle sfruttate di Google
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 9 set 2026 | Out of Bounds Write | Chromium V8 | Alta 8,8 | 3,5% |
| 4 set 2026 | Type Confusion | Chromium V8 | Alta 8,8 | 1,8% |
| 9 giu 2026 | Out-of-Bounds Read and Write | Chromium V8 | Alta 8,8 | 2,4% |
| 19 nov 2025 | Type Confusion | Chromium V8 | Alta 8,8 | 4,9% |
| 23 set 2025 | Type Confusion | Chromium V8 | Alta 8,8 | 9,0% |
| 2 lug 2025 | Type Confusion | Chromium V8 | Alta 8,1 | 14% |
| 5 giu 2025 | Out-of-Bounds Read and Write | Chromium V8 | Alta 8,8 | 7,8% |
| 28 ago 2024 | Inappropriate Implementation | Chromium V8 | Alta 8,8 | 19% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.