Security agencies are urging Google Chrome users to update their browsers to patch a critical vulnerability that could allow an attacker to take over a target’s system via a malicious link.
The critical vulnerability, CVE-2026-3913, is a heap buffer overflow affecting Google Chrome browser versions prior to 146.0.7680.71. The flaw could allow attackers to compromise a system simply by luring a victim to a malicious webpage. No malware download required. Just an unpatched browser and a single click.
The vulnerability was first reported by Google on March 10 as part of a release that patched 29 security vulnerabilities. On Thursday, security agencies urged businesses to prioritize patching the critical flaw.
“Successful exploitation of the vulnerabilities could lead to remote code execution, denial of service, information disclosure, security restriction bypass or spoofing on an affected system,” warned Hong Kong’s Government Computer Emergency Response Team.
The bug affects Chrome’s WebML component, the browser-native machine learning inference layer that has grown dramatically in surface area as web applications absorb AI capabilities. A remote attacker can trigger the heap buffer overflow with nothing more than a crafted webpage.
This release lands just weeks after Google issued an out-of-band emergency patch for CVE-2026-2441: a high-severity zero-day in Chrome’s CSS component that was actively exploited in the wild and was the first Chrome zero-day of 2026.
The heap buffer bug patched by Google also has implications for Microsoft’s Edge browser.
The Microsoft Edge Angle
The most recent Edge stable release (version 145.0.3800.97, dated March 6) is based on Chromium 145 and was included in Microsoft’s March Patch Tuesday on March 10. It does not incorporate the Chrome 146 vulnerability fixes, including CVE-2026-3913.
March’s Patch Tuesday Edge update addressed nine Chromium vulnerabilities from the previous generation — all rated “Exploitation Unlikely” — not the 29 patched in Chrome 146.
Microsoft’s Edge 146 web platform release, which incorporates the Chromium 146 security fixes, is arriving today, March 12. Edge users should update immediately and verify they are running version 146 or later via the Microsoft Edge security release notes page.
The High-Severity Surface: Use-After-Free Dominance
Beyond the critical WebML bugs, the patch resolves 11 high-severity vulnerabilities. The majority are Use-After-Free, or UAF, flaws — a vulnerability class that has consistently been Chrome’s most exploited category in recent years. UAF bugs arise when code continues to reference heap memory after it has been freed and potentially reallocated. An attacker who can spray heap memory and control reallocation timing can hijack control flow with precision.
The affected components read like a map of Chrome’s most privileged subsystems: Agents, the browser’s autonomous task orchestration layer expanded significantly for agentic browsing features; Extensions; WebMCP, the browser’s emerging Model Context Protocol integration; TextEncoding; MediaStream; WebMIDI; and WindowDialog. The presence of WebMCP is particularly notable — it signals that Chrome’s integrations with AI toolchains are already attracting security research attention before those features have reached mainstream adoption.
Medium and Low Severity: Not Noise
The remaining 17 vulnerabilities span the V8 JavaScript engine, Chrome’s PDF viewer, developer tools and navigation subsystems. While rated medium or low, security teams should not dismiss them. Flaws in this tier frequently serve as chaining primitives — an attacker combines a low-severity information leak with a high-severity memory corruption bug to build a reliable, sandbox-escaping exploit chain. The presence of side-channel information leaks and incorrect security UI implementations in this release is particularly relevant to that threat model.
How to Update
Security researcher Tobias Wienand discovered the critical browser flaw and disclosed it to Google through the Chrome Vulnerability Reward Program, earning a $33,000 bug bounty.
Updating Chrome takes less than two minutes.
On Windows or Mac, open Chrome and click the three-dot menu in the top-right corner, then go to Help > About Google Chrome. Chrome will automatically check for and download the update. Once it finishes, click Relaunch to apply it — the update is not active until the browser fully restarts.
On Android, open the Google Play Store and search for Chrome, or go to Play Store > your profile icon > Manage apps & device to see all pending updates. On iPhone or iPad, open the App Store, tap your profile icon at the top right and scroll down to see pending updates.
To confirm you’re protected, go back to Help > About Google Chrome after relaunching. You should see version 146.0.7680.71 on Linux, or 146.0.7680.71/146.0.7680.72 on Windows and Mac.
