Emergency Chrome 146 update patches 2 zero-day vulnerabilities

In the new Chrome versions 146.0.7680.75/76 for Windows and macOS, and 146.0.7680.75 for Linux, the developers have fixed two security vulnerabilities. According to Google, both vulnerabilities are already being exploited for attacks in the wild. This update comes only a day after Chrome versions 146.0.7680.71/72 for Windows and macOS, and 146.0.7680.71 for Linux, which fixed another 29 vulnerabilities.

In the Chrome Releases blog post, Srinivas Sista lists the two security vulnerabilities that were just fixed. They were discovered internally on February 10th and are classified as high risk.

As a general rule, Chrome automatically updates when a new version is available. But if you don’t have it yet, you can manually trigger the update via the menu item Help > About Google Chrome.

The zero-day security vulnerabilities

The first zero-day security vulnerability is a bug in the Skia graphics library (CVE-2026-3909) that allows write access to memory addresses outside the boundaries of a predefined buffer (“out-of-bounds write”).

The second zero-day vulnerability (CVE-2026-3910) is found in the V8 JavaScript engine, described as an “inappropriate implementation.” It remains unclear exactly what was implemented incorrectly and why this is such a problem.

Google is remaining tight-lipped on the nature and scale of the attacks exploiting these vulnerabilities.

Important: Whether you keep your browser up to date, you need proper antivirus protections if you want your PC to remain secure and private. Check out our picks for the best antivirus software for Windows as well as best VPN services to stay ahead of security problems.

What else is fixed in Chrome 146?

Just two days earlier, on March 10th, Google released the new major version Chrome 146, which you can read about in this Chrome Releases blog post. That update fixed 29 security vulnerabilities, almost all of which were reported by external security researchers.

One of the vulnerabilities (CVE-2026-3913) is classified as critical, a buffer overflow in the WebML component. Tobias Wienand, the discoverer of this vulnerability, was rewarded $33,000 for it. He also got an additional $43,000 for CVE-2026-3915, another WebML buffer overflow (although that one only classified as high risk).

Eleven security vulnerabilities were identified as high risk, and another eleven as medium risk. Google has so far awarded over $200,000 to those who discovered these vulnerabilities. In some cases, Google has not yet determined the amount of their respective rewards.