Google patches two Chrome zero-days under active attack. Update now

Two high-severity zero-day vulnerabilities (CVE-2026-3909 in Skia and CVE-2026-3910 in V8) were patched in Chrome desktop; update to 146.0.7680.75/76 for Windows/macOS or 146.0.7680.75 for Linux to be protected. Both flaws allow remote code execution via a malicious webpage with low attack complexity, raising real-world risk; organizations should apply the update immediately, enable automatic updates, and ensure endpoint/web-protection controls are current.

Analysis

This event increases the marginal value of real‑time endpoint detection, browser isolation, and fleet patch orchestration — the kind of services enterprises can buy quickly and scale across thousands of seats. Expect procurement cycles to accelerate: security teams will prioritize projects that reduce “unattended browser” exposure and that can be deployed without major user disruption, creating a near‑term spike in RFP activity that should convert to bookings over 1–3 quarters.

A less obvious beneficiary pool is the device‑management and patch‑orchestration vendors that sit upstream of security stacks. The cost and complexity of pushing coordinated updates across desktops, kiosks, and older OS images will force larger customers to centralize management, increasing wallet share for vendors that can demonstrate automated, auditable patch flow — this is where mid‑market MDMs and patch automation can expand ARR materially.

Regulatory and procurement second‑order effects matter: repeated low‑complexity exploits raise the probability of mandatory secure‑browser procurement or browser isolation requirements in regulated industries (financial, healthcare) within 12–24 months. That creates durable secular demand but also a short window for vendors to prove ROI; if no high‑profile exploit materializes in the next 30–90 days, sentiment may fade quickly and cause mean reversion in security multiples.

Key Decisions for Investors

• Buy CrowdStrike (CRWD) — 1.5–2.0% portfolio position via stock or 6‑month call spread. Rationale: highest probability to convert accelerated EDR procurement into ARR; target +25–35% in 3–9 months if RFPs accelerate, downside ~‑15% if the story fails to materialize.
• Overweight Zscaler (ZS) — 1% position in stock or 3–9 month ITM calls. Rationale: direct beneficiary from enterprise browser isolation and zero‑trust pushes; expected relative upside +20–30% in 6–12 months, tail risk is modular architecture wins going to incumbents instead.
• Buy Jamf (JAMF) — 0.5–1% position for 3–9 months. Rationale: MDM/patch orchestration demand for Apple/macOS fleets should see a short‑to‑mid term uplift; asymmetric payoff of +20–25% if enterprise projects accelerate, downside ~‑20% if spend is reallocated.
• Relative‑value pair: Long CRWD / Short SentinelOne (S) — equal notional over 3–6 months. Rationale: expect incumbent EDR vendor to out‑execute smaller peers on enterprise procurement and upsell; target CRWD to outperform S by 10–20% in 3–6 months, risk both rallying in a large exploit scenario.