Chrome 146 emergency updates fix exploited V8 and Skia zero-days (CVE-2026-3910, -3909)

In March 2026 Google shipped emergency Chrome updates for two vulnerabilities it said were being exploited in the wild: CVE-2026-3910 in the V8 JavaScript engine and CVE-2026-3909 in the Skia graphics library. Both are reachable from an ordinary web page. Both components are also bundled in Electron apps, CEF and other Chromium-based runtimes, so updating Chrome alone may not be enough.

What happened

Google's Threat Analysis Group (TAG) reported both bugs on 10 March 2026. Google fixed them in two releases:

• 12 March: Chrome 146.0.7680.75/76 (Windows, macOS) and 146.0.7680.75 (Linux) fixed CVE-2026-3910, rated high severity and described as an "inappropriate implementation in V8." Google said it was aware an exploit for it exists in the wild.
• 13 March: Chrome 146.0.7680.80 (Windows, macOS, Linux) fixed CVE-2026-3909, a high-severity out-of-bounds write in Skia, also exploited in the wild. Google's 12 March notes had originally listed this fix and were then corrected to say it would arrive in a later update.

As usual, Google withheld technical details while users update. SecurityWeek reported both bugs as CVSS 8.8. These were the second and third Chrome zero-days of 2026, after CVE-2026-2441, a CSS use-after-free fixed in February.

Who is affected

• Chrome desktop before 146.0.7680.80 (to be protected from both bugs).
• Other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) until they ship the matching Chromium fixes.
• Electron and CEF applications, including internal tools and desktop clients, which bundle their own V8 and Skia and only get fixed when the app ships a new Electron or CEF build.
• Headless Chrome used for scraping, PDF rendering, screenshots or end-to-end tests that loads untrusted pages.

What it means for developers and engineering teams

V8 and Skia are both attractive targets because they turn attacker-controlled input into memory operations. In V8, "inappropriate implementation" bugs are often logic errors in the JIT compiler's assumptions, such as type or bounds checks it wrongly removes, which give an attacker memory read and write inside the renderer. Skia processes fonts, images, paths and canvas operations from web content, so an out-of-bounds write there corrupts renderer memory directly. Either bug gives code execution in the renderer sandbox. Real attacks usually pair that with a sandbox escape, which this pair may or may not have included. Google hasn't said.

The engineering lesson is about vendored Chromium. Google updates Chrome itself, but your Electron app, your Puppeteer or Playwright browser downloads and your Docker images containing chromium are pinned to whatever version you built with. A headless renderer that fetches user-supplied URLs (link previews, HTML-to-PDF services, web scrapers) is an exposed browser running on your servers, often with fewer sandbox protections.

Timing matters too. Google's release notes for the 12 March update first listed both fixes and were then corrected to say the Skia fix would arrive in a later build. A day later, 146.0.7680.80 delivered it. Teams that patched on day one and then stopped tracking were still exposed to CVE-2026-3909. When an exploited-in-the-wild bug is announced, confirm the exact fixed build in the vendor's notes and check it against what is actually deployed, instead of assuming "we updated this week" is enough.

Many teams also run Chromium in places nobody thinks of as a browser: CI images for end-to-end tests, report generators, Slack-style link-unfurl workers, and screenshot services. A short inventory of every Dockerfile, package.json and system package list that pulls in Chromium is worth doing once, so the next emergency update takes minutes instead of a search across repositories.

What to do now

1. Update Chrome to 146.0.7680.80 or later: open chrome://settings/help and relaunch. Fleet admins can confirm with their management reporting or chrome://version.
2. Check other Chromium browsers and apply their March 2026 security releases.
3. Rebuild Electron apps on an Electron release that includes these fixes, and ship it through your auto-updater.
4. Update headless browsers: bump Puppeteer or Playwright and reinstall browsers (npx playwright install chromium), and rebuild container images that install chromium from distro packages.
5. Isolate renderers that load untrusted URLs. Never run them with --no-sandbox as root. Keep them in a separate container with no credentials and restricted outbound network access.

Related on TechLogHub

• Selenium vs Playwright, since both bundle or drive Chromium builds you need to keep current
• What is the DOM?

Sources

• Chrome Releases: Stable Channel Update for Desktop (12 March 2026)
• Chrome Releases: Stable Channel Update for Desktop (13 March 2026)
• SecurityWeek: Chrome 146 update patches two exploited zero-days
• The Register: Google fixes two Chrome zero-days