{"id":"chrome-exploited-v8-skia-mar-2026","category":"patch","status":"closed","title":"Chrome fixes exploited V8 and Skia flaws CVE-2026-3910 and CVE-2026-3909","tldr":"Two exploited flaws let malicious web pages corrupt Chrome's memory or run code within its sandbox. Desktop Chrome needs 146.0.7680.80 or later for both fixes; Edge Stable needs 146.0.3856.62 or later. Update to the latest release and relaunch.","summary":"Google disclosed two exploited flaws in Chrome's V8 JavaScript engine and Skia graphics library in March. A malicious web page could corrupt memory through Skia or run attacker-chosen code within Chrome's sandbox through V8. Google rated both high severity. Its 12 March desktop update fixed V8; on 13 March, Google corrected that notice and released Chrome 146.0.7680.80 for Windows, macOS and Linux to fix Skia. Early BleepingComputer coverage said the first release fixed both, but Google's revised notices supersede that claim. Microsoft fixed V8 in Edge Stable on 13 March and Skia on 16 March. CISA listed both as exploited on 13 March. As at 3 November, fixes are available for the desktop Chrome and Edge Stable versions covered here. Google's notices do not identify victims or give victim numbers. Other products using these components require their own vendors' updates.","action":"Install the latest Chrome update and relaunch it; desktop version 146.0.7680.80 is the minimum covering both flaws. If you use Edge, update and relaunch that too; Edge Stable 146.0.3856.62 is the minimum covering both.","product":"Google Chrome and Microsoft Edge Stable on Windows, macOS and Linux","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-3909","CVE-2026-3910"],"tags":["google","chrome","microsoft","edge","browser","zero-day"],"affected":["Google Chrome desktop before 146.0.7680.75: CVE-2026-3910","Google Chrome desktop before 146.0.7680.80: CVE-2026-3909, including the initial 146.0.7680.75/76 update","Microsoft Edge Stable before 146.0.3856.59: CVE-2026-3910","Microsoft Edge Stable before 146.0.3856.62: CVE-2026-3909"],"fixed":["Google Chrome 146.0.7680.75/76 for Windows and macOS, and 146.0.7680.75 for Linux: V8 fix","Google Chrome 146.0.7680.80 for Windows, macOS and Linux: both fixes","Microsoft Edge Stable 146.0.3856.59: V8 fix","Microsoft Edge Stable 146.0.3856.62: both fixes"],"matches":[{"platform":"macos","app":"Google Chrome","bundle":"com.google.Chrome","fixed":"146.0.7680.80"},{"platform":"windows","app":"Google Chrome","bundle":"","fixed":"146.0.7680.80"},{"platform":"linux","app":"Google Chrome","bundle":"","fixed":"146.0.7680.80"},{"platform":"macos","app":"Microsoft Edge","bundle":"com.microsoft.edgemac","fixed":"146.0.3856.62"},{"platform":"windows","app":"Microsoft Edge","bundle":"","fixed":"146.0.3856.62"},{"platform":"linux","app":"Microsoft Edge","bundle":"","fixed":"146.0.3856.62"}],"sources":[{"kind":"advisory","title":"Stable Channel Update for Desktop — 12 March, corrected 13 March","url":"https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html","by":"Google","date":"2026-03-12"},{"kind":"advisory","title":"Stable Channel Update for Desktop — 13 March","url":"https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html","by":"Google","date":"2026-03-13"},{"kind":"advisory","title":"Release notes for Microsoft Edge Security Updates — 13 and 16 March entries","url":"https://learn.microsoft.com/en-ca/deployedge/microsoft-edge-relnotes-security","by":"Microsoft","date":"2026-03-16"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue — entries for CVE-2026-3909 and CVE-2026-3910","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-10-30"},{"kind":"news","title":"Google fixes two new Chrome zero-days exploited in attacks","url":"https://www.bleepingcomputer.com/news/google/google-fixes-two-new-chrome-zero-days-exploited-in-attacks/","by":"BleepingComputer","date":"2026-03-13"},{"kind":"advisory","title":"Google Chrome Multiple Vulnerabilities","url":"https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260313","by":"HKCERT","date":"2026-03-16"},{"kind":"advisory","title":"Google Releases Security Update for Chrome","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4755","by":"NHS England","date":"2026-03-13"}],"started":"2026-03-12","closed":"2026-03-16","created":"2026-11-03T20:30:37.781Z","updated":"2026-11-03T20:30:37.781Z","cve_notes":[{"cve":"CVE-2026-3909","name":"Out-of-bounds write in Chrome's Skia graphics library","what":"A flaw in Skia, Chrome's graphics library, lets a malicious web page write outside the intended memory area and corrupt memory.","severity":"high","cvss":8.8},{"cve":"CVE-2026-3910","name":"Code execution flaw in Chrome's V8 JavaScript engine","what":"An implementation flaw in V8, Chrome's JavaScript engine, lets a malicious web page run attacker-chosen code within the browser's sandbox.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-03-16","added":"2026-11-03T20:12:05.486Z","kind":"new-fix","text":"Microsoft released Edge Stable 146.0.3856.62 with the Skia fix for CVE-2026-3909. Both desktop Chrome and Edge Stable now had released fixes for the pair.","url":"https://learn.microsoft.com/en-ca/deployedge/microsoft-edge-relnotes-security","by":"Microsoft","patch":"patched"},{"at":"2026-03-13","added":"2026-11-03T20:12:05.486Z","kind":"new-fix","text":"Microsoft released Edge Stable 146.0.3856.59 with the V8 fix for CVE-2026-3910. Edge's Skia fix followed separately.","url":"https://learn.microsoft.com/en-ca/deployedge/microsoft-edge-relnotes-security","by":"Microsoft","patch":"partial"},{"at":"2026-03-13","added":"2026-11-03T20:12:05.486Z","kind":"cisa-added","text":"CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalogue, with a 27 March remediation deadline for US federal civilian agencies.","url":"https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-03-13","added":"2026-11-03T20:12:05.486Z","kind":"new-fix","text":"Google released Chrome 146.0.7680.80 for Windows, macOS and Linux to fix CVE-2026-3909 in Skia, also confirming exploitation. Desktop Chrome now had fixes for both flaws.","url":"https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html","by":"Google","patch":null},{"at":"2026-03-13","added":"2026-11-03T20:12:05.486Z","kind":"vendor-revised","text":"Google corrected its 12 March notice: CVE-2026-3909 had been included incorrectly and needed a separate update. The first release therefore did not fix both flaws.","url":"https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html","by":"Google","patch":"partial"},{"at":"2026-03-12","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"Google released Chrome 146.0.7680.75/76 for Windows and macOS and 146.0.7680.75 for Linux, fixing CVE-2026-3910 in V8. Google confirmed exploitation.","url":"https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html","by":"Google","patch":"partial"}],"url":"https://hard.fyi/live/chrome-exploited-v8-skia-mar-2026/","json":"https://hard.fyi/api/live?id=chrome-exploited-v8-skia-mar-2026"}