Google Patches Critical WebML Vulnerability and 28 Other Flaws in Chrome 146
Take action: If you are using Google Chrome or other Chromium-based browsers (Edge, Brave, Vivaldi, Opera...) patch your browser ASAP. Google wouldn't push a new update so soon unless it's serious. Even if you want to debate the severity scoring, it's better to just update. Because while you debate, hackers will find a way to exploit them.
Learn More
Google has released a security update for Chrome on March 10, 2026, elevating the browser to version 146.0.7680.71/72 for Windows and macOS, and 146.0.7680.71 for Linux. This release includes 29 security fixes designed to address several high-impact vulnerabilities.
Vulnerabilities summary:
Critical and high severity flaws:
- CVE-2026-3913 (CVSS TBD, Google severity Critical): Heap buffer overflow in WebML. This flaw carries a significant risk of arbitrary code execution and was awarded a $33,000 bounty.
- CVE-2026-3914 (CVSS TBD, Google severity High): Integer overflow in WebML.
- CVE-2026-3915 (CVSS TBD, Google severity High): Heap buffer overflow in WebML.
- CVE-2026-3916 (CVSS TBD, Google severity High): Out of bounds read in Web Speech.
- CVE-2026-3917 through CVE-2026-3924 (CVSS TBD, Google severity High): Multiple Use-after-free vulnerabilities affecting various components including Agents, WebMCP, Extensions, TextEncoding, MediaStream, WebMIDI, and WindowDialog.
- CVE-2026-3920 (CVSS TBD, Google severity High): Out of bounds memory access in WebML.
The update also addresses 17 additional bugs of Medium and Low severity, including incorrect security UI in LookalikeChecks and PictureInPicture, insufficient policy enforcement in PDF and DevTools, and a heap buffer overflow in the Skia graphics library.
All Chrome versions prior to 146.0.7680.71 are vulnerable to these security flaws. Users running any version below these build numbers should update immediately.
Patched Versions:
- Chrome 146.0.7680.71 or later for Linux
- Chrome 146.0.7680.71 or 146.0.7680.72 for Windows and Mac
Google is restricting access to detailed technical information and bug links until the majority of users have applied the security patches. This is a standard precaution to prevent widespread exploitation of the newly disclosed flaws.
Chrome users are strongly advised to update their browsers ASAP by navigating to Chrome menu > Help > About Google Chrome and relaunching once the download is complete. Users who do not close their browsers regularly should manually check for updates to ensure they receive these critical security protections.
