endpoint-software-vulnerabilitywidely-deployed-product-advisory

Google Chrome Stable Channel Update Fixes 29 Vulnerabilities Including Critical WebML Heap Overflow

Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Mar 12, 2026

Google released Chrome 146 to the Stable channel for Windows, macOS, and Linux, addressing 29 security vulnerabilities in versions prior to 146.0.7680.71/72 (Windows/macOS) and 146.0.7680.71 (Linux). The most severe issue highlighted is CVE-2026-3913, a critical heap buffer overflow in WebML that could enable remote code execution when a user visits a maliciously crafted webpage; additional high-severity fixes include multiple memory-safety bugs such as use-after-free and out-of-bounds read conditions across browser components.

The Canadian Centre for Cyber Security issued advisory AV26-220 urging organizations to review Google’s guidance and apply the Chrome updates as they become available. A separate Canadian advisory, AV26-206, covers Microsoft Edge Stable updates for versions prior to 145.0.3800.97; while also Chromium-based, it is a distinct vendor release and should be tracked separately from the Chrome 146 patch cycle.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Mar 10, 2026 – Mar 12, 2026

Mar 12, 20268mo ago
Google publishes follow-up Chrome advisory for newer stable versions
On March 12, 2026, Google published another Chrome stable channel security advisory covering versions prior to 146.0.7680.75/76 on Windows and Mac and prior to 146.0.7680.75 on Linux. Google said exploits for CVE-2026-3909 and CVE-2026-3910 exist in the wild, indicating active exploitation.
Mar 10, 20268mo ago
Google issues Chrome 146 stable update fixing 29 vulnerabilities
On March 10, 2026, Google released Chrome 146 to the stable channel for Windows, macOS, and Linux, addressing 29 security vulnerabilities in versions prior to 146.0.7680.71/72 on Windows and Mac and prior to 146.0.7680.71 on Linux. The fixes included critical CVE-2026-3913, a heap buffer overflow in WebML that could enable remote code execution via a malicious web page.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Heap Buffer Overflow in Google Chrome WebML (CVE-2026-3913)

Organizations

1 linked

Google

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Ca CcsNews · Mar 13, 2026

Google Chrome security advisory (AV26-235) - Canadian Centre for Cyber SecurityOpen source ↗

Cyber Security NewsNews · Mar 12, 2026

Chrome Security Update - Patch for 29 Vulnerabilities that Allows Remote Code ExecutionOpen source ↗

Ca CcsNews · Mar 11, 2026

Google Chrome security advisory (AV26-220) - Canadian Centre for Cyber SecurityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Google Chrome Stable Channel Update Fixes 29 Vulnerabilities Including Critical WebML Heap Overflow

How this story unfolded

Google publishes follow-up Chrome advisory for newer stable versions

Google issues Chrome 146 stable update fixing 29 vulnerabilities

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Google Chrome Stable Channel Update Fixes Three High-Severity Vulnerabilities

Google Chrome Update Fixes 79 Flaws, Including 14 Critical Bugs

Chrome Desktop Update Fixes 28 Flaws Including Critical Memory Corruption Bugs

Google Chrome Stable Channel Update Fixes 29 Vulnerabilities Including Critical WebML Heap Overflow

How this story unfolded

Google publishes follow-up Chrome advisory for newer stable versions

Google issues Chrome 146 stable update fixing 29 vulnerabilities

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Google Chrome Stable Channel Update Fixes Three High-Severity Vulnerabilities

Google Chrome Update Fixes 79 Flaws, Including 14 Critical Bugs

Chrome Desktop Update Fixes 28 Flaws Including Critical Memory Corruption Bugs