{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "chrome-attacked-bug-mar-2026",
  "url": "https://patchgap.ai/incidents/chrome-attacked-bug-mar-2026/",
  "path": "/incidents/chrome-attacked-bug-mar-2026/",
  "json_url": "https://patchgap.ai/incidents/chrome-attacked-bug-mar-2026.json",
  "title": "Chrome and Edge (Mar 2026): bugs in the parts that run website code (V8) and draw images (Skia) were used in real attacks",
  "category": "browsers",
  "platforms": [
   "windows",
   "macos",
   "linux"
  ],
  "products": [
   "chrome",
   "edge"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
  "exploited_in_wild": "yes",
  "exploited_note": "Google says it is aware that attacks using CVE-2026-3910, CVE-2026-3909 exist. CISA lists them as used in real attacks (added 2026-03-13).",
  "exploited_source_url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-03-13",
  "updated_at": "2026-10-27",
  "cves": [
   "CVE-2026-3910",
   "CVE-2026-3909"
  ],
  "summary": "A bad website could use a bug in the parts that run website code (V8) and draw images (Skia) of Chrome to run its own code on your computer. Attackers were already using it. Google fixed it in Chrome 146.0.7680.80. Edge is built on the same code and got the same fix. Both update themselves, but only after you restart the browser.",
  "am_i_affected": "You are at risk if Chrome is older than 146.0.7680.80 or Edge is older than 146.0.3856.62. Newer versions are safe from this one.",
  "action": "Update Chrome to 146.0.7680.80 or newer and restart Edge",
  "affected": [
   {
    "product": "chrome",
    "product_name": "Google Chrome",
    "platform": "windows",
    "affected_versions": "Chrome versions before 146.0.7680.80",
    "fixed_version": "146.0.7680.80",
    "fixed_min": "146.0.7680.80",
    "fix_note": null,
    "fixed_source_urls": [
     "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html"
    ],
    "check": {
     "menu_path": "Click the three dots at the top right > Help > About Google Chrome. Chrome checks for updates there, then click Relaunch.",
     "command": "(Get-ItemProperty 'HKCU:\\Software\\Google\\Chrome\\BLBeacon' -ErrorAction SilentlyContinue).version",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://support.google.com/chrome/answer/95414"
   },
   {
    "product": "chrome",
    "product_name": "Google Chrome",
    "platform": "macos",
    "affected_versions": "Chrome versions before 146.0.7680.80",
    "fixed_version": "146.0.7680.80",
    "fixed_min": "146.0.7680.80",
    "fix_note": null,
    "fixed_source_urls": [
     "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html"
    ],
    "check": {
     "menu_path": "Chrome menu bar: Chrome > About Google Chrome.",
     "command": "defaults read \"/Applications/Google Chrome.app/Contents/Info\" CFBundleShortVersionString",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://support.google.com/chrome/answer/95414"
   },
   {
    "product": "chrome",
    "product_name": "Google Chrome",
    "platform": "linux",
    "affected_versions": "Chrome versions before 146.0.7680.80",
    "fixed_version": "146.0.7680.80",
    "fixed_min": "146.0.7680.80",
    "fix_note": null,
    "fixed_source_urls": [
     "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html"
    ],
    "check": {
     "menu_path": "Chrome menu: three dots > Help > About Google Chrome.",
     "command": "google-chrome --version",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://support.google.com/chrome/answer/95414"
   },
   {
    "product": "edge",
    "product_name": "Microsoft Edge",
    "platform": "windows",
    "affected_versions": "Edge versions before 146.0.3856.62",
    "fixed_version": "146.0.3856.62",
    "fixed_min": "146.0.3856.62",
    "fix_note": null,
    "fixed_source_urls": [
     "https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security"
    ],
    "check": {
     "menu_path": "Click the three dots at the top right > Help and feedback > About Microsoft Edge.",
     "command": "(Get-Item \"${env:ProgramFiles(x86)}\\Microsoft\\Edge\\Application\\msedge.exe\" -ErrorAction SilentlyContinue).VersionInfo.ProductVersion",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://www.microsoft.com/edge/download"
   },
   {
    "product": "edge",
    "product_name": "Microsoft Edge",
    "platform": "macos",
    "affected_versions": "Edge versions before 146.0.3856.62",
    "fixed_version": "146.0.3856.62",
    "fixed_min": "146.0.3856.62",
    "fix_note": null,
    "fixed_source_urls": [
     "https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security"
    ],
    "check": {
     "menu_path": "Edge menu bar: Microsoft Edge > About Microsoft Edge.",
     "command": "defaults read \"/Applications/Microsoft Edge.app/Contents/Info\" CFBundleShortVersionString",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://www.microsoft.com/edge/download"
   }
  ],
  "fix_steps": [
   "In Chrome, open the three-dot menu > Help > About Google Chrome. It checks and downloads the update.",
   "Click Relaunch.",
   "In Edge, open the three-dot menu > Help and feedback > About Microsoft Edge, then click Restart."
  ],
  "official_patch_links": [
   {
    "label": "Google: update Chrome",
    "url": "https://support.google.com/chrome/answer/95414"
   },
   {
    "label": "Google Chrome release note",
    "url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html"
   },
   {
    "label": "Microsoft Edge security release notes",
    "url": "https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html",
    "title": "Google Chrome Releases: Stable Channel Update for Desktop (2026-03-13)",
    "date": "2026-03-13",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-3910, CVE-2026-3909 (added 2026-03-13)",
    "date": "2026-03-13",
    "kind": "cisa",
    "official": true
   },
   {
    "url": "https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security",
    "title": "Microsoft: Release notes for Microsoft Edge security updates",
    "date": "2026-03-16",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3910",
    "title": "NVD: CVE-2026-3910",
    "date": "2026-03-13",
    "kind": "nvd",
    "official": true
   }
  ]
 }
}