Out-of-Bounds Write in Google Chrome's Skia Rendering Engine
CISA: Google Skia Out-of-Bounds Write Vulnerability
CVSS 3.1
8.8high
EPSS
2%p75
Published
()
KEV added
AI analysis
CVE-2026-3909 is an out-of-bounds write (CWE-787) in the Skia graphics rendering library used by Google Chrome, which Google patched in Chrome 146.0.7680.75. A remote attacker can trigger the flaw by luring a user to visit a crafted HTML page, causing out-of-bounds memory access in the browser process; the High CVSS 8.8 score with high confidentiality, integrity, and availability impact indicates memory corruption with potentially serious consequences. All Google Chrome installations running versions prior to 146.0.7680.75 are affected, and because the vulnerability resides in the Skia engine, the vulnerable code is present in every Chrome install. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-03-13, indicating exploitation in the wild, though no public proof-of-concept is known and ransomware use is unknown. EPSS currently assigns a 1.6% probability of exploitation within the next 30 days (75th percentile).
What to do: Update Google Chrome to version 146.0.7680.75 or later on all endpoints, prioritizing systems with privileged or high-risk users; confirm the updated version is deployed rather than relying on auto-update timing. As an interim mitigation, restrict web browsing on sensitive systems and warn users about visiting untrusted pages; federal agencies must apply the fix per BOD 22-01 requirements given the KEV listing.
Affected
Google Chrome (Skia rendering engine)
all versions prior to 146.0.7680.75
Google Skia (as shipped in Google Chrome, per CISA)
prior to Chrome 146.0.7680.75
Estimated exposure
massbillions of users (Chrome is the world's most widely used desktop and mobile browser) — Chrome holds roughly two-thirds of global browser market share, translating to an install base in the billions, and the flaw sits in the core Skia rendering engine present in every installation, with the fixed version 146.0.7680.75 only…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CISA Known Exploited Vulnerability
Affected
Google Skia
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Google patched 12 Chrome flaws including in-the-wild V8 zero-day CVE-2026-85046; CISA added it to the KEV catalog.
Google released Chrome 152.0.7977.82/.83 for Windows and Mac (152.0.7977.82 for Linux) fixing 12 vulnerabilities, including CVE-2026-85046, a type confusion flaw in the V8 JavaScript engine being exploited in the wild. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities Catalog with a patch deadline of September 18, 2026. This is Chrome's sixth zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645. The other 11 fixes include use-after-free, out-of-bounds, race condition and input validation flaws in Skia, WebGL, DevTools, Network, Compositing and other components.
Google patches actively exploited Chrome V8 zero-day CVE-2026-85046 (CVSS 8.8); CISA adds it to KEV with a September 18 deadline.
Google fixed 12 Chrome vulnerabilities, including CVE-2026-85046, a high-severity (CVSS 8.8) type confusion bug in the V8 JavaScript and WebAssembly engine. The flaw, reported by researcher Salvatore Gulizia on August 4, 2026, allows remote arbitrary code execution inside the browser sandbox via a crafted HTML page. Google confirmed the exploit exists in the wild, and CISA added the CVE to its KEV catalog, requiring Federal Civilian Executive Branch agencies to patch by September 18, 2026. This is the sixth actively exploited Chrome zero-day patched in 2026.
Google patched 230 Chrome flaws in version 153.0.8010.36, including actively exploited V8 out-of-bounds write CVE-2026-87491 (CVSS 8.8), the seventh 2026 Chrome zero-day.
Google released Chrome 153.0.8010.36 on Linux and 153.0.8010.36/.37 on Windows and Mac, fixing 230 security vulnerabilities. CVE-2026-87491, an out-of-bounds write in the V8 JavaScript and WebAssembly engine (CVSS 8.8), is being exploited in the wild through specially crafted HTML pages to execute arbitrary code inside Chrome's sandbox. Google says it is the seventh actively exploited Chrome zero-day of 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046. Researcher Jihyeon Jeong of Seoul National University reported it on 2026-08-06 and received a $2,500 bounty; Google disclosed no technical details or attribution.
Google patches actively exploited Chrome zero-day CVE-2026-85046, a V8 type confusion bug enabling sandboxed code execution via crafted HTML pages.
Google patched 12 Chrome vulnerabilities, including CVE-2026-85046, a CVSS 8.8 type confusion flaw in the V8 JavaScript and WebAssembly engine exploited in the wild. The bug, reported by researcher Salvatore Gulizia (Serotav) on August 4, 2026, allows arbitrary code execution inside the sandbox via a crafted HTML page; the researcher described it as a V8 compiler bug enabling arbitrary read/write on the JavaScript heap. Fixes shipped in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, and this is the sixth Chrome zero-day Google has fixed in 2026.
Google patched 12 Chrome flaws including actively exploited V8 type confusion zero-day CVE-2026-85046 (CVSS 8.8), enabling sandboxed remote code execution via crafted webpages.
Google released Chrome Stable 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, fixing 12 vulnerabilities including CVE-2026-85046, a type confusion in V8 with a CVSS score of 8.8. Google says an exploit exists in the wild, making this the sixth actively exploited Chrome zero-day of 2026. The bug affects the JavaScript and WebAssembly engine and allows arbitrary code execution inside the browser sandbox via a specially crafted HTML page. Researcher Salvatore Gulizia (Serotav) reported the flaw on August 4, 2026 and received a $1,000 bounty.
Google patches actively exploited Chrome V8 zero-day CVE-2026-87491, an out-of-bounds write enabling sandboxed code execution via crafted HTML pages.
Google released Chrome 153.0.8010.36/.37 fixing 230 vulnerabilities, including CVE-2026-87491, an out-of-bounds write in the V8 engine that allowed remote code execution inside the sandbox via a crafted HTML page and is confirmed to be exploited in the wild. The flaw was reported on August 6, 2026 by Jihyeon Jeong of Compsec Lab, Seoul National University, who received a $2,500 bug bounty. This is the seventh actively exploited Chrome zero-day of 2026. The update also fixes five critical flaws in WebGL and Cast, plus a high WebPackaging use-after-free (CVE-2026-87639) credited to OpenAI Codex Security.
CISA added actively exploited Chrome V8 type-confusion flaw CVE-2026-85046 (CVSS 8.8) to its KEV catalog; Google patched it in Chrome 152.
CISA added CVE-2026-85046 (CVSS 8.8), a V8 type confusion flaw, to its Known Exploited Vulnerabilities catalog, requiring US federal agencies to patch by September 18, 2026. Google fixed it in Chrome Stable 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, alongside 11 other vulnerabilities. The bug lets a remote attacker execute arbitrary code inside the browser sandbox via a crafted HTML page and is the sixth actively exploited Chrome zero-day of 2026. Researcher Salvatore Gulizia (Serotav) reported it on August 4, 2026.
Google patched actively exploited Chrome V8 out-of-bounds write CVE-2026-87491; CISA added it to KEV with a September 23 patch deadline.
Google fixed 230 Chrome vulnerabilities in its stable channel update, including CVE-2026-87491, an out-of-bounds write in the V8 JavaScript engine being exploited in the wild. The flaw, reported by Jihyeon Jeong of Compsec Lab, Seoul National University, is the seventh Chrome zero-day patched by Google in 2026. It affects Chrome versions before 153.0.8010.36, and CISA added it to the Known Exploited Vulnerabilities Catalog urging patching before September 23, 2026. Users should upgrade to Chrome 153.0.8010.36 (Linux) or 153.0.8010.36/.37 (Windows/Mac); Qualys customers can detect vulnerable assets with QID 388666.
Google patched actively exploited Chrome zero-day CVE-2026-87491, a V8 out-of-bounds write enabling sandboxed code execution, in Chrome 153.0.8010.36+.
Google fixed 230 Chrome vulnerabilities including CVE-2026-87491, a Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that allows remote arbitrary code execution inside the sandbox via a crafted HTML page. Google confirmed an exploit exists in the wild; fixes shipped in Chrome 153.0.8010.36 and .37 for Windows and macOS and 153.0.8010.36 for Linux. The flaw was reported August 6, 2026 by Jihyeon Jeong of Seoul National University's Compsec Lab, earning a $2,500 bounty. It is the seventh actively exploited Chrome zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645 and CVE-2026-85046.
Google patches Chrome V8 zero-day CVE-2026-87491, exploited in the wild, marking the seventh exploited Chrome zero-day of 2026, in an update fixing 230 flaws.
Google released Chrome 153 with fixes for 230 vulnerabilities, including CVE-2026-87491, a medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google says is being exploited in the wild. It is the seventh zero-day patched in Chrome in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645 and CVE-2026-85046. The update also fixes five critical bugs (four in WebGL, one in Cast), 41 high-severity defects, and more than 180 medium/low issues, rolling out as 153.0.8010.36/.37 for Windows/macOS and 153.0.8010.36 for Linux.