CVE-2026-3909
Google Skia Out-of-Bounds Write Vulnerability
Description
CVE-2026-3909 is a HIGH out-of-bounds write vulnerability in Google Skia, the graphics engine used by Google Chrome, carrying a CVSS 3.1 score of 8.8. An out-of-bounds write in Skia in Chrome prior to version 146.0.7680.75 allows a remote attacker to perform out-of-bounds memory access via a crafted HTML page. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2026-03-13 with a remediation deadline of 2026-03-27. With an EPSS score of 0.331 (33.1%), this vulnerability demonstrates significant real-world exploitation probability and should be prioritized for immediate remediation across all environments running affected Chrome versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 146.0.7680.80 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html(Release Notes, Vendor Advisory)
- https://issues.chromium.org/issues/491421267(Permissions Required)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3909(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2026-3909 is classified under CWE-787 — Out-of-bounds Write. An out-of-bounds write vulnerability occurs when a program writes data past the end or before the beginning of a buffer's allocated memory. This can corrupt adjacent data in memory, crash the application, or — in the most severe cases — allow an attacker to execute arbitrary code by overwriting critical control structures such as function pointers, return addresses, or heap metadata.
In the context of Google Skia, the graphics rendering library at the heart of Chrome and many other applications, out-of-bounds write vulnerabilities are particularly dangerous. Skia processes complex graphical data from untrusted web content, including fonts, SVGs, canvas operations, and image decoding. A flaw in bounds checking during these operations means a carefully crafted HTML page can trigger memory corruption in the renderer process. While Chrome's multi-process sandbox architecture provides some containment, renderer exploits are frequently chained with sandbox escapes, making any OOB write in Skia a high-value target for sophisticated threat actors.
Impact Analysis
CVE-2026-3909 carries a CVSS 3.1 score of 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Confidentiality (HIGH): Successful exploitation can allow an attacker to read sensitive data from the Chrome renderer process memory, including session tokens, authentication cookies, and data from other web origins sharing the same process.
Integrity (HIGH): The out-of-bounds write primitive enables an attacker to modify memory contents, potentially achieving arbitrary code execution within the renderer process. This could be used to alter web page content, intercept user input, or serve as a stepping stone toward full system compromise.
Availability (HIGH): Exploitation can cause Chrome to crash or become unresponsive. In targeted attacks, the availability impact is secondary to the code execution potential, but drive-by exploitation at scale could cause widespread browser instability.
The attack requires no privileges and only minimal user interaction — visiting a malicious or compromised web page. The low attack complexity and network-accessible vector make this vulnerability particularly suitable for watering-hole attacks and malvertising campaigns.
Exploit Maturity
CVE-2026-3909 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog as of 2026-03-13.
Exploit status: The inclusion in the KEV catalog confirms that threat actors have successfully weaponized this vulnerability. Chrome zero-days in Skia have historically been used in targeted surveillance campaigns and by advanced persistent threat groups. The EPSS score of 33.1% places it well above the threshold for expected in-the-wild exploitation.
Ransomware association: No direct ransomware association has been confirmed at this time. However, browser-based initial access vulnerabilities are increasingly incorporated into delivery chains for both espionage and financially motivated operations.
Attack surface: Any device running Google Chrome (or Chromium-based browsers such as Microsoft Edge, Brave, or Opera) prior to version 146.0.7680.75 is vulnerable. The attack requires only that a user navigate to a page containing the crafted HTML content, making drive-by download scenarios highly feasible.
KEV deadline: CISA has set a remediation deadline of 2026-03-27. Given confirmed exploitation, all organizations should update Chrome immediately without waiting for regular patch cycles.
Remediation
- Update Google Chrome immediately. Ensure all instances of Google Chrome are updated to version 146.0.7680.75 or later. Verify that automatic updates are functioning correctly across your fleet. Chromium-based browsers (Edge, Brave, Opera) should also be checked for corresponding patches.
- Enforce browser version compliance. Use endpoint management tools to verify that no devices in your environment are running vulnerable Chrome versions. Block or alert on outdated browser versions through your security tooling.
- Implement interim mitigations if patching is delayed. If immediate patching is not possible, consider restricting access to untrusted web content, enabling site isolation policies, and deploying web content filtering to reduce exposure to malicious HTML content.
- Review browser security policies. Ensure Chrome enterprise policies are configured to enforce automatic updates, restrict dangerous downloads, and enable enhanced safe browsing protections.
- Scan for indicators of compromise. Given confirmed active exploitation, review endpoint detection logs for unusual Chrome renderer crashes, suspicious child process spawning from Chrome, or anomalous network activity following browser use.
- Communicate the urgency to end users. Inform users about the active exploitation and instruct them to restart their browsers to apply pending updates. Consider forced restarts via policy if your organization supports it.
Technical Details
CVE-2026-3909 is a HIGH-severity out-of-bounds write vulnerability in the Skia graphics library as integrated into Google Chrome. The vulnerability is remotely exploitable over the network with low attack complexity. No authentication or privileges are required, though minimal user interaction (visiting a web page) is necessary to trigger the flaw.
Technical mechanism: The vulnerability resides in Skia's handling of specific graphical operations when processing crafted HTML content. Insufficient bounds validation during a write operation allows data to be written beyond the allocated buffer. In the Chrome rendering pipeline, Skia processes numerous complex data types — including paths, shaders, images, and text rendering instructions — from potentially untrusted web content. The specific flaw allows an attacker-controlled value to influence a write offset or length, resulting in corruption of adjacent heap memory.
CVSS 3.1 vector analysis (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): The Network attack vector reflects that exploitation occurs through normal web browsing. Low attack complexity indicates no special conditions are required. No privileges are needed, but user interaction (navigating to a malicious page) is required. The Unchanged scope means impact is contained within the Chrome process boundary at the vulnerability level, though practical exploitation may chain with additional flaws. All three impact metrics are HIGH, reflecting the potential for full read/write access to renderer process memory and code execution.
Affected versions: Google Chrome prior to 146.0.7680.75. All platforms (Windows, macOS, Linux, ChromeOS) running affected versions are vulnerable.
Frequently Asked Questions
What is CVE-2026-3909?
CVE-2026-3909 is a HIGH-severity (CVSS 8.8) out-of-bounds write vulnerability in Google Skia, the graphics library used by Chrome. It allows remote attackers to perform out-of-bounds memory access via crafted HTML content. The vulnerability is actively exploited in the wild and is listed in CISA's KEV catalog.
Which browsers are affected by CVE-2026-3909?
Google Chrome prior to version 146.0.7680.75 is directly affected. Other Chromium-based browsers — including Microsoft Edge, Brave, Opera, and Vivaldi — may also be affected if they incorporate the vulnerable Skia code. Check each browser vendor's security advisories for their specific patched versions.
How do I fix CVE-2026-3909?
Update Google Chrome to version 146.0.7680.75 or later immediately. You can check your current version by navigating to chrome://settings/help. Enable automatic updates to ensure timely protection against future vulnerabilities. For enterprise environments, use your endpoint management platform to push and verify the update across all managed devices.
How severe is CVE-2026-3909?
CVE-2026-3909 is rated HIGH with a CVSS score of 8.8 and an EPSS score of 33.1%. It is actively exploited in the wild and has been added to CISA's KEV catalog with a remediation deadline of 2026-03-27. The combination of remote exploitability, low complexity, and full impact across confidentiality, integrity, and availability makes this a critical priority for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.