Two Chrome zero-days in March 2026: CVE-2026-3909 and CVE-2026-5281

March 2026 brought two separate Chrome zero-day alerts. On 13 March, Google fixed CVE-2026-3909, an out-of-bounds write in the Skia graphics library reported by its Threat Analysis Group. On 31 March it fixed CVE-2026-5281, a use-after-free in the Dawn WebGPU implementation. For both, Google confirmed that an exploit existed in the wild.

CVE-2026-3909 was addressed in desktop Chrome 146.0.7680.80. The second event moved stable to 146.0.7680.177/178 on Windows and macOS and 146.0.7680.177 on Linux, with corresponding Android fixes. Google restricted bug details until most users updated, so attributing a specific exploit chain or threat actor would go beyond confirmed facts.

What the bug classes mean

An out-of-bounds write corrupts memory beyond an intended buffer. Use-after-free accesses an object after its memory has been released. Either can crash a process or enable controlled corruption. Full system compromise from a browser often also requires a sandbox escape; an in-the-wild exploit does not prove that every observed chain delivered system privileges.

Skia processes graphics and rendered formats. Dawn provides WebGPU and reaches the GPU stack. Both are exposed to web content, so normal monthly patch cadence is too slow.

Browser-update runbook

Verify the running process version, not only MDM policy status. Force a browser restart because a downloaded update does not protect an old process. Measure devices below the target after 24 and 48 hours, including laptops outside VPN.

Plan migration for unsupported operating systems; “latest available” may still be vulnerable. Chromium-based products have separate release schedules, so Chrome’s number says nothing about Edge, Brave or Electron patch status. Inventory the embedded engine too.

In EDR, correlate renderer or GPU anomalies with unusual child processes, executable writes or outbound connections. Browser isolation, disabling unnecessary WebGPU and least privilege reduce impact but do not replace patching.

The two zero-days show why vulnerability management needs an out-of-band path. For an exploited browser flaw, the KPI should be measured in hours. We can verify real endpoint coverage and compensating controls.

Device-group priorities

Patch administrator workstations, finance users, journalists, executives and shared-mailbox operators first because they are attractive targeted-exploitation candidates. Then cover the whole fleet; a watering hole or malicious advertisement need not know the user’s role.

VDI and kiosks need a separate process. The golden image may be fixed while a running session remains old. For non-persistent pools, verify the next boot consumes the new image and rollback cannot restore a vulnerable snapshot.

If a device was exposed

Visiting a page is not proof of exploitation. If a high-risk device used an affected build during active campaigns and EDR shows a renderer anomaly, isolate it and preserve memory and telemetry. Review child processes, downloads, persistence, browser tokens and sign-ins from new devices.

Changing passwords on a possibly compromised host can hand the new password to the actor. Use a clean device, revoke sessions and then rotate credentials. For privileged users, inspect MFA registration and OAuth applications.

Browser maintenance as a security programme

Assign owners for Chrome, Edge, Firefox and Electron applications. Collect versions daily, force restart after a grace period and deny critical SaaS access below minimum version. Report median and p95 update time rather than only “95% compliant”.

Does disabling JavaScript protect users? It may stop some chains, while Skia and other parsers also process media. It is a disruptive emergency mitigation, not a patch replacement.

Communicating without panic

Give users one action: save work, open “About Chrome”, wait for the update and restart. A technical CVE notice without a task is ineffective. Administrators should enforce updates and measure the running version because user confirmation is not evidence.

If devices cannot update, remove access to email, admin panels and finance applications until migration. Every exception needs an owner and expiry. In-the-wild exploitation makes the risk operational even when Google withholds campaign targets.

---

Primary sources: Chrome Releases — CVE-2026-3909, 13 March, Chrome Releases — CVE-2026-5281, 31 March.