March 2026 Third-Party Vulnerabilities and Patches 

March marked a clear increase in vulnerability and remediation activity compared to February. We identified 249 unique vulnerabilities affecting 81 applications, and remediation work resulted in 139 unique updates during the month. Both the volume of findings and patching activity rose notably, making March one of the more active periods so far this year. 

Last month stands out due to the volume of vulnerabilities remediated, but this is largely explained by how vendors released patches during that time. Several major products shipped bulk security updates, where a single version fixed dozens of vulnerabilities at once. Browsers and runtimes in particular accounted for much of the increase, as they routinely bundle large numbers of memory‑safety fixes into scheduled releases. 

Notable vulnerabilities in March 2026 third-party patches 

CVE-2026-5281, CVE‑2026‑3910, and CVE‑2026‑3909 all stand out this month due to the availability of public exploits. While not all environments will be directly exposed, the existence of working exploits significantly increases the risk of real‑world abuse and shortens the time window for safe remediation.  

CVE-2026-5281 is a high‑severity vulnerability in Google Chrome’s Dawn component, which implements WebGPU functionality. The flaw is a use‑after‑free condition that can be triggered after an attacker has already compromised the browser’s renderer process. By abusing this memory‑safety issue through a specially crafted HTML page, an attacker can achieve arbitrary code execution within the context of the browser. Google confirmed that this vulnerability was actively exploited in the wild prior to the availability of a patch. It has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. The assigned CVSS 3 score of 8.8 (High) reflects both the technical impact and the realistic exploitation potential when combined with other browser flaws. More information is available in the Chrome Releases security advisory and CISA’s KEV entry. 

CVE‑2026‑3910 affects Google Chrome’s V8 JavaScript engine and is caused by an inappropriate implementation that can be abused through a specially crafted HTML page. The flaw allows a remote attacker to execute arbitrary code inside the browser’s sandbox, without requiring authentication or direct user interaction beyond visiting a malicious webpage. This isn’t the first time V8 has had a zero-day vulnerability. Google has confirmed that CVE‑2026‑3910 has been actively exploited in the wild, and the vulnerability is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. As with other V8 vulnerabilities, Chromium‑based browsers that lag behind Chrome’s patch cadence may also be affected. Organizations should prioritize updating Chrome and other Chromium‑based browsers to patched versions, particularly in environments where users routinely browse untrusted or external web content. Additional technical details and remediation guidance are available through Chrome Releases and CISA KEV. 

CVE–2026–3909 is a high‑severity vulnerability in Google Skia, an open‑source 2D graphics library used by Google Chrome and a broad range of other platforms, including ChromeOS, Android, Flutter, and additional Chromium‑based products. The vulnerability is an out‑of‑bounds write, triggered via a crafted HTML page, which allows a remote attacker to perform out‑of‑bounds memory access. The vulnerability was actively exploited in the wild prior to patch availability, and it has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. The issue affects Google Chrome versions prior to 146.0.7680.75, but due to Skia’s widespread use, the potential impact extends beyond Chrome itself. Products embedding Skia or relying on Chromium components may also be affected depending on how quickly upstream patches were integrated. More information can be found on Chrome Releases security advisory and CISA KEV. 

March also saw several vulnerabilities assigned the maximum CVSS score of 10, indicating critical severity and the potential for full compromise of affected systems if exploited. CVE-2026-4689, CVE-2026-4725 and CVE–2026–4692 impact Mozilla Firefox and Thunderbird, where flaws in boundary handling can lead to sandbox escape scenarios, allowing malicious code to break out of browser isolation. CVE–2026–4688 also affects Firefox through a use‑after‑free condition in the Disability Access APIs, which could enable elevated impact under specific conditions. 

CVE‑2025‑68121 is a critical vulnerability in the Go programming language’s crypto/tls library. Any Go‑based software that uses the affected TLS functionality may be impacted. This includes Microsoft Azure Kubelogin, which relies on Go’s TLS implementation to authenticate and integrate Azure identity with Kubernetes clusters. 
 

Browser security updates in March 2026 

Major browsers, including Google Chrome, Microsoft Edge, Brave, Mozilla Firefox (including ESR versions), Opera One, Vivaldi, and others received numerous security updates addressing various vulnerabilities.  

Microsoft product updates included in March 2026 third-party patches 

Microsoft issued security updates for several other products: 

• Microsoft .NET Runtime 10.0 
• Microsoft .NET Runtime 8.0 
• Microsoft .NET Runtime 9.0 
• Microsoft .NET SDK 10.0 
• Microsoft .NET SDK 8.0 
• Microsoft .NET SDK 9.0 
• Microsoft 365 Apps 
• Microsoft ASP.NET Core Runtime 10.0 
• Microsoft ASP.NET Core Runtime 8.0 
• Microsoft ASP.NET Core Runtime 9.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 10.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 8.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 9.0 
• Microsoft Azure CLI 
• Microsoft Edge Beta 
• Microsoft Edge for Business 
• Microsoft Project 
• Microsoft Visio 
• Microsoft Visual Studio 2022 Community 
• Microsoft Visual Studio 2022 Enterprise 
• Microsoft Visual Studio 2022 Professional 
• Microsoft Visual Studio Code 
• Microsoft Visual Studio Team Explorer 2022 
• Microsoft Windows Desktop Runtime 10.0 
• Microsoft Windows Desktop Runtime 8.0 
• Microsoft Windows Desktop Runtime 9.0 

Detailed list of March 2026 third-party patches 

For a complete list of applications, versions, and the number of remediated vulnerabilities, see the table below generated using Application Workspace data. 

Application management at the speed of your operations 

Vulnerabilities move fast, especially in a distributed workforce. Discover how Recast’s application management product, Application Workspace, helps IT teams keep applications patched, compliant, and correctly configured, wherever work happens.