Microsoft Edge WebView2 Runtime 146.0.3856.59
Microsoft Edge WebView2 Runtime 146.0.3856.59, released March 13, 2026, fixes 31 CVEs in Microsoft Edge WebView2 Runtime. One of them is being exploited (CVE-2026-3910); 1 on CISA KEV. Patch Radar priority: Patch now. The latest Microsoft Edge WebView2 Runtime is 157.0.4341.42, which also fixes every one of these CVEs.
Superseded. The latest Microsoft Edge WebView2 Runtime is 157.0.4341.42, which also fixes every CVE on this page. Install that instead.
Priority of the 31 CVEs
Applies to
| Product | Version |
|---|---|
| Microsoft Edge WebView2 Runtime | 146.0.3856.59 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Patch now | CVE-2026-3910 | Chromium: CVE-2026-3910 Inappropriate implementation in V8 | 8.8 | 0.0268 | KEVExploited |
| Urgent | CVE-2026-3916 | Chromium: CVE-2026-3916 Out of bounds read in Web Speech | 9.6 | 0.0040 | None reported |
| Urgent | CVE-2026-3931 | Chromium: CVE-2026-3931 Heap buffer overflow in Skia | 9.6 | 0.0032 | None reported |
| High | CVE-2026-3913 | Chromium: CVE-2026-3913 Heap buffer overflow in WebML | 8.8 | 0.0046 | None reported |
| High | CVE-2026-3915 | Chromium: CVE-2026-3915 Heap buffer overflow in WebML | 8.8 | 0.0044 | None reported |
| High | CVE-2026-3914 | Chromium: CVE-2026-3914 Integer overflow in WebML | 8.8 | 0.0040 | None reported |
| High | CVE-2026-3917 | Chromium: CVE-2026-3917 Use after free in Agents | 8.8 | 0.0040 | None reported |
| High | CVE-2026-3537 | Chromium: CVE-2026-3537 Object lifecycle issue in PowerVR | 8.8 | 0.0038 | None reported |
| High | CVE-2026-3918 | Chromium: CVE-2026-3918 Use after free in WebMCP | 8.8 | 0.0038 | None reported |
| High | CVE-2026-3921 | Chromium: CVE-2026-3921 Use after free in TextEncoding | 8.8 | 0.0036 | None reported |
| High | CVE-2026-3920 | Chromium: CVE-2026-3920 Out of bounds memory access in WebML | 8.8 | 0.0034 | None reported |
| High | CVE-2026-3922 | Chromium: CVE-2026-3922 Use after free in MediaStream | 8.8 | 0.0031 | None reported |
| High | CVE-2026-3923 | Chromium: CVE-2026-3923 Use after free in WebMIDI | 8.8 | 0.0031 | None reported |
| High | CVE-2026-3936 | Chromium: CVE-2026-3936 Use after free in WebView | 8.8 | 0.0031 | None reported |
| High | CVE-2026-3924 | Chromium: CVE-2026-3924 Use after free in WindowDialog | 7.5 | 0.0031 | None reported |
| High | CVE-2026-3919 | Chromium: CVE-2026-3919 Use after free in Extensions | 8.8 | 0.0030 | None reported |
| High | CVE-2026-3926 | Chromium: CVE-2026-3926 Out of bounds read in V8 | 8.8 | 0.0026 | None reported |
| High | CVE-2026-3932 | Chromium: CVE-2026-3932 Insufficient policy enforcement in PDF | 7.5 | 0.0021 | None reported |
| Routine | CVE-2026-3937 | Chromium: CVE-2026-3937 Incorrect security UI in Downloads | 6.5 | 0.0021 | None reported |
| Routine | CVE-2026-3934 | Chromium: CVE-2026-3934 Insufficient policy enforcement in ChromeDriver | 6.5 | 0.0021 | None reported |
| Routine | CVE-2026-3927 | Chromium: CVE-2026-3927 Incorrect security UI in PictureInPicture | 4.3 | 0.0020 | None reported |
| Routine | CVE-2026-3942 | Chromium: CVE-2026-3942 Incorrect security UI in PictureInPicture | 4.3 | 0.0020 | None reported |
| Routine | CVE-2026-3938 | Chromium: CVE-2026-3938 Insufficient policy enforcement in Clipboard | 4.3 | 0.0020 | None reported |
| Routine | CVE-2026-3941 | Chromium: CVE-2026-3941 Insufficient policy enforcement in DevTools | 4.3 | 0.0019 | None reported |
| Routine | CVE-2026-3929 | Chromium: CVE-2026-3929 Side-channel information leakage in ResourceTiming | 3.1 | 0.0019 | None reported |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.