Microsoft Edge WebView2 Runtime 146.0.3856.72
Microsoft Edge WebView2 Runtime 146.0.3856.72, released March 20, 2026, fixes 24 CVEs in Microsoft Edge WebView2 Runtime. None of them is reported as exploited. Patch Radar priority: Urgent. The latest Microsoft Edge WebView2 Runtime is 157.0.4341.42, which also fixes every one of these CVEs.
Superseded. The latest Microsoft Edge WebView2 Runtime is 157.0.4341.42, which also fixes every CVE on this page. Install that instead.
Priority of the 24 CVEs
Applies to
| Product | Version |
|---|---|
| Microsoft Edge WebView2 Runtime | 146.0.3856.72 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-4448 | Chromium: CVE-2026-4448 Heap buffer overflow in ANGLE | 9.6 | 0.0030 | None reported |
| Urgent | CVE-2026-4460 | Chromium: CVE-2026-4460 Out of bounds read in Skia | 9.6 | 0.0028 | None reported |
| Urgent | CVE-2026-4464 | Chromium: CVE-2026-4464 Integer overflow in ANGLE | 9.6 | 0.0028 | None reported |
| Urgent | CVE-2026-4452 | Chromium: CVE-2026-4452 Integer overflow in ANGLE | 9.6 | 0.0026 | None reported |
| High | CVE-2026-4443 | Chromium: CVE-2026-4443 Heap buffer overflow in WebAudio | 8.8 | 0.0043 | None reported |
| High | CVE-2026-4447 | Chromium: CVE-2026-4447 Inappropriate implementation in V8 | 8.8 | 0.0037 | None reported |
| High | CVE-2026-4457 | Chromium: CVE-2026-4457 Type Confusion in V8 | 8.8 | 0.0037 | None reported |
| High | CVE-2026-4440 | Chromium: CVE-2026-4440 Out of bounds read and write in WebGL | 8.8 | 0.0034 | None reported |
| High | CVE-2026-4461 | Chromium: CVE-2026-4461 Inappropriate implementation in V8 | 8.8 | 0.0033 | None reported |
| High | CVE-2026-4441 | Chromium: CVE-2026-4441 Use after free in Base | 8.8 | 0.0033 | None reported |
| High | CVE-2026-4463 | Chromium: CVE-2026-4463 Heap buffer overflow in WebRTC | 8.8 | 0.0031 | None reported |
| High | CVE-2026-4444 | Chromium: CVE-2026-4444 Stack buffer overflow in WebRTC | 8.8 | 0.0030 | None reported |
| High | CVE-2026-4446 | Chromium: CVE-2026-4446 Use after free in WebRTC | 8.8 | 0.0029 | None reported |
| High | CVE-2026-4450 | Chromium: CVE-2026-4450 Out of bounds write in V8 | 8.8 | 0.0029 | None reported |
| High | CVE-2026-4459 | Chromium: CVE-2026-4459 Out of bounds read and write in WebAudio | 8.8 | 0.0029 | None reported |
| High | CVE-2026-4442 | Chromium: CVE-2026-4442 Heap buffer overflow in CSS | 8.8 | 0.0028 | None reported |
| High | CVE-2026-4445 | Chromium: CVE-2026-4445 Use after free in WebRTC | 8.8 | 0.0026 | None reported |
| High | CVE-2026-4449 | Chromium: CVE-2026-4449 Use after free in Blink | 8.8 | 0.0026 | None reported |
| High | CVE-2026-4451 | Chromium: CVE-2026-4451 Insufficient validation of untrusted input in Navigation | 8.8 | 0.0026 | None reported |
| High | CVE-2026-4454 | Chromium: CVE-2026-4454 Use after free in Network | 8.8 | 0.0026 | None reported |
| High | CVE-2026-4456 | Chromium: CVE-2026-4456 Use after free in Digital Credentials API | 8.8 | 0.0026 | None reported |
| High | CVE-2026-4462 | Chromium: CVE-2026-4462 Out of bounds read in Blink | 8.8 | 0.0026 | None reported |
| High | CVE-2026-4455 | Chromium: CVE-2026-4455 Heap buffer overflow in PDFium | 8.8 | 0.0026 | None reported |
| High | CVE-2026-4458 | Chromium: CVE-2026-4458 Use after free in Extensions | 8.8 | 0.0020 | None reported |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.