Brave has released a new browser update that fixes two Chromium vulnerabilities that were reportedly being exploited in the wild. The company shared the announcement through its official social media account, urging users to install the update as soon as possible.
According to Brave, the update — version 1.88.130 — includes security fixes for two Chromium vulnerabilities identified as CVE-2026-3909 and CVE-2026-3910. These vulnerabilities were disclosed in the Chrome CNA database on March 12, 2026.
In its post, Brave said:
“⚠️ Today’s browser update (v1.88.130) contains fixes for Chromium vulnerabilities found to be exploited in the wild. You may have received the automatic Brave update already. If not, you can manually update by visiting ‘About Brave’ from the browser’s menu. The Android update is waiting on Google Play Store review and should be out shortly.”
The first flaw, CVE-2026-3909, is described as an out-of-bounds write issue in Skia, the graphics engine used by Chromium-based browsers. According to the description, the vulnerability affects versions of Chrome prior to 146.0.7680.75 and could allow a remote attacker to perform memory access out of bounds using a specially crafted HTML page. The issue is rated with high severity under Chromium’s security classification.
The second vulnerability, CVE-2026-3910, involves an inappropriate implementation in the V8 JavaScript engine. The flaw could allow a remote attacker to execute arbitrary code within the browser’s sandbox through a crafted HTML page. Like the first issue, it also carries a high severity rating.
Because Brave is built on the Chromium engine, the company pushed the patch through its latest browser update. Users who have automatic updates enabled may already have the fix installed, but those who have not yet received it can check manually by opening the Brave menu and selecting About Brave to trigger the update.
Brave also clarified that the issue does not affect the iOS version of the browser, since the iOS build does not rely on Chromium but rather the WebKit rendering engine as mandated by Apple’s App Store Policy.
The Android version of the update is currently awaiting review on the Google Play Store, but Brave says it should become available shortly.
Stay tuned for more updates!
