Chrome fixes exploited V8 and Skia flaws CVE-2026-3910 and CVE-2026-3909
Two exploited flaws let malicious web pages corrupt Chrome's memory or run code within its sandbox. Desktop Chrome needs 146.0.7680.80 or later for both fixes; Edge Stable needs 146.0.3856.62 or later. Update to the latest release and relaunch.
Install the latest Chrome update and relaunch it; desktop version 146.0.7680.80 is the minimum covering both flaws. If you use Edge, update and relaunch that too; Edge Stable 146.0.3856.62 is the minimum covering both.
- Google Chromefixed in 146.0.7680.80 and later
- Google Chromefixed in 146.0.7680.80 and later
- Google Chromefixed in 146.0.7680.80 and later
- Microsoft Edgefixed in 146.0.3856.62 and later
- Microsoft Edgefixed in 146.0.3856.62 and later
- Microsoft Edgefixed in 146.0.3856.62 and later
What’s happening
Google disclosed two exploited flaws in Chrome's V8 JavaScript engine and Skia graphics library in March. A malicious web page could corrupt memory through Skia or run attacker-chosen code within Chrome's sandbox through V8. Google rated both high severity. Its 12 March desktop update fixed V8; on 13 March, Google corrected that notice and released Chrome 146.0.7680.80 for Windows, macOS and Linux to fix Skia. Early BleepingComputer coverage said the first release fixed both, but Google's revised notices supersede that claim. Microsoft fixed V8 in Edge Stable on 13 March and Skia on 16 March. CISA listed both as exploited on 13 March. As at 3 November, fixes are available for the desktop Chrome and Edge Stable versions covered here. Google's notices do not identify victims or give victim numbers. Other products using these components require their own vendors' updates.
- What
- Flaw
- Affects
- Google Chrome and Microsoft Edge Stable on Windows, macOS and Linux
- Affected
- Google Chrome desktop before 146.0.7680.75: CVE-2026-3910
Google Chrome desktop before 146.0.7680.80: CVE-2026-3909, including the initial 146.0.7680.75/76 update
Microsoft Edge Stable before 146.0.3856.59: CVE-2026-3910
Microsoft Edge Stable before 146.0.3856.62: CVE-2026-3909 - Fixed in
- Google Chrome 146.0.7680.75/76 for Windows and macOS, and 146.0.7680.75 for Linux: V8 fix
Google Chrome 146.0.7680.80 for Windows, macOS and Linux: both fixes
Microsoft Edge Stable 146.0.3856.59: V8 fix
Microsoft Edge Stable 146.0.3856.62: both fixes - Since
- 12 Mar 2026
- Closed
- 16 Mar 2026
Timeline
- New fixFixed
Microsoft released Edge Stable 146.0.3856.62 with the Skia fix for CVE-2026-3909. Both desktop Chrome and Edge Stable now had released fixes for the pair.
- New fixPartly fixed
Microsoft released Edge Stable 146.0.3856.59 with the V8 fix for CVE-2026-3910. Edge's Skia fix followed separately.
- CISA added
CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalogue, with a 27 March remediation deadline for US federal civilian agencies.
- New fix
Google released Chrome 146.0.7680.80 for Windows, macOS and Linux to fix CVE-2026-3909 in Skia, also confirming exploitation. Desktop Chrome now had fixes for both flaws.
- Vendor revisedPartly fixed
Google corrected its 12 March notice: CVE-2026-3909 had been included incorrectly and needed a separate update. The first release therefore did not fix both flaws.
- Made publicPartly fixed
Google released Chrome 146.0.7680.75/76 for Windows and macOS and 146.0.7680.75 for Linux, fixing CVE-2026-3910 in V8. Google confirmed exploitation.
Sources
- Stable Channel Update for Desktop — 12 March, corrected 13 MarchGoogle · 12 Mar 2026
- Stable Channel Update for Desktop — 13 MarchGoogle · 13 Mar 2026
- Release notes for Microsoft Edge Security Updates — 13 and 16 March entriesMicrosoft · 16 Mar 2026
- Known Exploited Vulnerabilities catalogue — entries for CVE-2026-3909 and CVE-2026-3910CISA · 30 Oct 2026
- Google fixes two new Chrome zero-days exploited in attacksBleepingComputer · 13 Mar 2026
- Google Chrome Multiple VulnerabilitiesHKCERT · 16 Mar 2026
- Google Releases Security Update for ChromeNHS England · 13 Mar 2026