Chrome 2026 in-the-wild zero-days (seven by September)
CVE-2026-2441 (Feb)
- Disclosed
What happened
- CVE-2026-3909 / -3910 (Mar)
- CVE-2026-5281 (Dawn use-after-free, 1 Apr)
- CVE-2026-11645 (Jun)
- CVE-2026-85046 (3 to 4 Sep)
- CVE-2026-87491 (V8, Chrome 153, 8 Sep; KEV 9 Sep)
Live scores
Live scores
CVE-2026-2441- EPSS
- 0.550
very likely to be attacked soon - VEDAS
- 0.982
strong exploit evidence - On CISA KEV
- Yes, since 2026-02-17
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-3909- EPSS
- 0.023
some chance of attack soon - VEDAS
- 0.975
strong exploit evidence - On CISA KEV
- Yes, since 2026-03-13
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-3910- EPSS
- 0.027
some chance of attack soon - VEDAS
- 0.976
strong exploit evidence - On CISA KEV
- Yes, since 2026-03-13
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-5281- EPSS
- 0.137
likely to be attacked soon - VEDAS
- 0.979
strong exploit evidence - On CISA KEV
- Yes, since 2026-04-01
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-11645- EPSS
- 0.024
some chance of attack soon - VEDAS
- 0.976
strong exploit evidence - On CISA KEV
- Yes, since 2026-06-09
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-85046- EPSS
- 0.018
some chance of attack soon - VEDAS
- 0.981
strong exploit evidence - On CISA KEV
- Yes, since 2026-09-04
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://www.helpnetsecurity.com/2026/09/04/google-chrome-zero-day-cve-2026-85046/
- https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html
- https://chromereleases.googleblog.com/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.