# Microsoft Edge WebView2 Runtime 146.0.3856.59 Microsoft Edge WebView2 Runtime 146.0.3856.59, released March 13, 2026, fixes 31 CVEs in Microsoft Edge WebView2 Runtime. One of them is being exploited (CVE-2026-3910); 1 on CISA KEV. Patch Radar priority: Patch now. The latest Microsoft Edge WebView2 Runtime is 157.0.4341.42, which also fixes every one of these CVEs. - Web page: https://patchblox.com/security/fix/windows-app/microsoft.edgewebview2runtime-146.0.3856.59 - Platform: Windows apps - Released: Mar 13, 2026 - Priority: Patch now (Closes CVE-2026-3910, exploited (CISA KEV)) - CVEs: 31, exploited: 1, on CISA KEV: 1 - Superseded by: [Microsoft Edge WebView2 Runtime 157.0.4341.42](https://patchblox.com/security/data/product/windows-app/microsoft-edge-webview2-runtime.md), the latest version, which also fixes every CVE listed here ## Applies to | Product | Release | Fixed in | |---|---|---| | [Microsoft Edge WebView2 Runtime](https://patchblox.com/security/data/product/windows-app/microsoft-edge-webview2-runtime.md) | | 146.0.3856.59 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-3910](https://patchblox.com/security/data/cve/CVE-2026-3910.md) | Patch now | Chromium: CVE-2026-3910 Inappropriate implementation in V8 | 8.8 | 0.0268 | CISA KEV | | [CVE-2026-3916](https://patchblox.com/security/data/cve/CVE-2026-3916.md) | Urgent | Chromium: CVE-2026-3916 Out of bounds read in Web Speech | 9.6 | 0.0040 | | | [CVE-2026-3931](https://patchblox.com/security/data/cve/CVE-2026-3931.md) | Urgent | Chromium: CVE-2026-3931 Heap buffer overflow in Skia | 9.6 | 0.0032 | | | [CVE-2026-3913](https://patchblox.com/security/data/cve/CVE-2026-3913.md) | High | Chromium: CVE-2026-3913 Heap buffer overflow in WebML | 8.8 | 0.0046 | | | [CVE-2026-3915](https://patchblox.com/security/data/cve/CVE-2026-3915.md) | High | Chromium: CVE-2026-3915 Heap buffer overflow in WebML | 8.8 | 0.0044 | | | [CVE-2026-3914](https://patchblox.com/security/data/cve/CVE-2026-3914.md) | High | Chromium: CVE-2026-3914 Integer overflow in WebML | 8.8 | 0.0040 | | | [CVE-2026-3917](https://patchblox.com/security/data/cve/CVE-2026-3917.md) | High | Chromium: CVE-2026-3917 Use after free in Agents | 8.8 | 0.0040 | | | [CVE-2026-3537](https://patchblox.com/security/data/cve/CVE-2026-3537.md) | High | Chromium: CVE-2026-3537 Object lifecycle issue in PowerVR | 8.8 | 0.0038 | | | [CVE-2026-3918](https://patchblox.com/security/data/cve/CVE-2026-3918.md) | High | Chromium: CVE-2026-3918 Use after free in WebMCP | 8.8 | 0.0038 | | | [CVE-2026-3921](https://patchblox.com/security/data/cve/CVE-2026-3921.md) | High | Chromium: CVE-2026-3921 Use after free in TextEncoding | 8.8 | 0.0036 | | | [CVE-2026-3920](https://patchblox.com/security/data/cve/CVE-2026-3920.md) | High | Chromium: CVE-2026-3920 Out of bounds memory access in WebML | 8.8 | 0.0034 | | | [CVE-2026-3922](https://patchblox.com/security/data/cve/CVE-2026-3922.md) | High | Chromium: CVE-2026-3922 Use after free in MediaStream | 8.8 | 0.0031 | | | [CVE-2026-3923](https://patchblox.com/security/data/cve/CVE-2026-3923.md) | High | Chromium: CVE-2026-3923 Use after free in WebMIDI | 8.8 | 0.0031 | | | [CVE-2026-3936](https://patchblox.com/security/data/cve/CVE-2026-3936.md) | High | Chromium: CVE-2026-3936 Use after free in WebView | 8.8 | 0.0031 | | | [CVE-2026-3924](https://patchblox.com/security/data/cve/CVE-2026-3924.md) | High | Chromium: CVE-2026-3924 Use after free in WindowDialog | 7.5 | 0.0031 | | | [CVE-2026-3919](https://patchblox.com/security/data/cve/CVE-2026-3919.md) | High | Chromium: CVE-2026-3919 Use after free in Extensions | 8.8 | 0.0030 | | | [CVE-2026-3926](https://patchblox.com/security/data/cve/CVE-2026-3926.md) | High | Chromium: CVE-2026-3926 Out of bounds read in V8 | 8.8 | 0.0026 | | | [CVE-2026-3932](https://patchblox.com/security/data/cve/CVE-2026-3932.md) | High | Chromium: CVE-2026-3932 Insufficient policy enforcement in PDF | 7.5 | 0.0021 | | | [CVE-2026-3937](https://patchblox.com/security/data/cve/CVE-2026-3937.md) | Routine | Chromium: CVE-2026-3937 Incorrect security UI in Downloads | 6.5 | 0.0021 | | | [CVE-2026-3934](https://patchblox.com/security/data/cve/CVE-2026-3934.md) | Routine | Chromium: CVE-2026-3934 Insufficient policy enforcement in ChromeDriver | 6.5 | 0.0021 | | | [CVE-2026-3927](https://patchblox.com/security/data/cve/CVE-2026-3927.md) | Routine | Chromium: CVE-2026-3927 Incorrect security UI in PictureInPicture | 4.3 | 0.0020 | | | [CVE-2026-3942](https://patchblox.com/security/data/cve/CVE-2026-3942.md) | Routine | Chromium: CVE-2026-3942 Incorrect security UI in PictureInPicture | 4.3 | 0.0020 | | | [CVE-2026-3938](https://patchblox.com/security/data/cve/CVE-2026-3938.md) | Routine | Chromium: CVE-2026-3938 Insufficient policy enforcement in Clipboard | 4.3 | 0.0020 | | | [CVE-2026-3941](https://patchblox.com/security/data/cve/CVE-2026-3941.md) | Routine | Chromium: CVE-2026-3941 Insufficient policy enforcement in DevTools | 4.3 | 0.0019 | | | [CVE-2026-3929](https://patchblox.com/security/data/cve/CVE-2026-3929.md) | Routine | Chromium: CVE-2026-3929 Side-channel information leakage in ResourceTiming | 3.1 | 0.0019 | | | [CVE-2026-3935](https://patchblox.com/security/data/cve/CVE-2026-3935.md) | Routine | Chromium: CVE-2026-3935 Incorrect security UI in WebAppInstalls | 6.5 | 0.0019 | | | [CVE-2026-3930](https://patchblox.com/security/data/cve/CVE-2026-3930.md) | Routine | Chromium: CVE-2026-3930 Unsafe navigation in Navigation | 5.3 | 0.0018 | | | [CVE-2026-3940](https://patchblox.com/security/data/cve/CVE-2026-3940.md) | Routine | Chromium: CVE-2026-3940 Insufficient policy enforcement in DevTools | 5.3 | 0.0018 | | | [CVE-2026-3925](https://patchblox.com/security/data/cve/CVE-2026-3925.md) | Routine | Chromium: CVE-2026-3925 Incorrect security UI in LookalikeChecks | 4.3 | 0.0017 | | | [CVE-2026-3939](https://patchblox.com/security/data/cve/CVE-2026-3939.md) | Routine | Chromium: CVE-2026-3939 Use after free in WebView | 5.3 | 0.0017 | | | [CVE-2026-3928](https://patchblox.com/security/data/cve/CVE-2026-3928.md) | Routine | Chromium: CVE-2026-3928 Insufficient policy enforcement in Extensions | 4.3 | 0.0014 | | --- Data as of 2026-11-11T07:45:43Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.