Skip to content
NewA calmer, faster ZeroHour
VulnerabilityKEV3

CVE-2026-3909

Out-of-Bounds Write in Google Chrome's Skia Rendering Engine

CISA: Google Skia Out-of-Bounds Write Vulnerability

CVSS 3.1
8.8 high
EPSS
2%p84
Published
·
Added to KEV
Analyze CVE-2026-3909 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

CVE-2026-3909 is an out-of-bounds write (CWE-787) in the Skia graphics rendering library used by Google Chrome, which Google patched in Chrome 146.0.7680.75. A remote attacker can trigger the flaw by luring a user to visit a crafted HTML page, causing out-of-bounds memory access in the browser process; the High CVSS 8.8 score with high confidentiality, integrity, and availability impact indicates memory corruption with potentially serious consequences. All Google Chrome installations running versions prior to 146.0.7680.75 are affected, and because the vulnerability resides in the Skia engine, the vulnerable code is present in every Chrome install. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-03-13, indicating exploitation in the wild, though no public proof-of-concept is known and ransomware use is unknown. EPSS currently assigns a 1.6% probability of exploitation within the next 30 days (75th percentile).

What to do: Update Google Chrome to version 146.0.7680.75 or later on all endpoints, prioritizing systems with privileged or high-risk users; confirm the updated version is deployed rather than relying on auto-update timing. As an interim mitigation, restrict web browsing on sensitive systems and warn users about visiting untrusted pages; federal agencies must apply the fix per BOD 22-01 requirements given the KEV listing.

ProductAffected
Google Chrome (Skia rendering engine)all versions prior to 146.0.7680.75
Google Skia (as shipped in Google Chrome, per CISA)prior to Chrome 146.0.7680.75
Estimated exposure
massbillions of users (Chrome is the world's most widely used desktop and mobile browser) — Chrome holds roughly two-thirds of global browser market share, translating to an install base in the billions, and the flaw sits in the core Skia rendering engine present in every installation, with the fixed version 146.0.7680.75 only…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

KEVCISA Known Exploited Vulnerability
Affected
Google Skia
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due date
Ransomware use
Unknown
Vendors
google
Products
chrome
Weakness
CWE-787
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD CVE.org CISA KEV GitHub PoCs EPSS (2.3%)

In the news

20 stories