CVE-2026-3909

8.8

HIGH CVSS 3.1

Google Skia Out-of-Bounds Write Vulnerability - [Actively Exploited]

Overview

Description

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Details

INFO

Published Date :

March 13, 2026, 7:55 p.m.

Last Modified :

March 25, 2026, 2:05 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Mar 27, 2026

Alert Date: Mar 13, 2026 | 20 days ago

Description :

Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-3909

Impact

Affected Products

The following products are affected by CVE-2026-3909 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Microsoft	windows
2	Microsoft	edge_chromium
1	Linux	linux_kernel
1	Google	chrome
1	Apple	macos

: Total Affected Vendor : 4 | Products : 5

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				134c704f-9b21-4f2e-91b3-4a467353bcc0
	CVSS 3.1	HIGH				[email protected]

Solution

Update Google Chrome to version 146.0.7680.75 or later to fix an out-of-bounds write vulnerability.

Update Google Chrome to the latest version.
Ensure the browser is updated automatically.

Public PoC/Exploit Available at Github

CVE-2026-3909 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-3909.

URL	Resource
https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html	Release Notes Vendor Advisory
https://issues.chromium.org/issues/491421267	Permissions Required
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3909	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-3909 is associated with the following CWEs:

CWE-787: Out-of-bounds Write

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-3909 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

w4zu/Debian_security

DSA and DLA for Debian last 14 days

Python

Updated: 1 week, 4 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 12, 2025, 2:08 p.m. This repo has been linked 194 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-3909 vulnerability anywhere in the article.

TheCyberThrone

CVE-2026-5281 — Google Chrome Dawn Use-After-Free Under Active Exploitation

April 2, 2026CISA has added CVE-2026-5281 to its Known Exploited Vulnerabilities catalog, marking the fourth Chrome zero-day exploited in the wild during 2026 alone. Federal agencies are required to r ...

Published Date: Apr 02, 2026 (2 hours, 4 minutes ago)

The Hacker News

New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch Released

Google on Thursday released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild. The high-severity vulnerab ...

Published Date: Apr 01, 2026 (16 hours, 42 minutes ago)

CybersecurityNews

CISA Warns of Chrome 0-Day Vulnerabilities Exploited in Attacks

CISA Warns of Chrome 0-Day Vulnerabilities Exploit An urgent warning regarding two highly critical zero-day vulnerabilities affecting Google Chrome and related products. These flaws have been official ...

Published Date: Mar 17, 2026 (2 weeks, 1 day ago)

Daily CyberSecurity

Weekly Threat Intelligence Briefing: Chrome Zero-Days, SolarWinds RCE, and a Surge in Critical PoCs

The Executive Summary Over the past seven days, our CVE Watchtower intercepted 1,388 new vulnerabilities, highlighting a relentless week in the cybersecurity landscape. While the sheer volume is high, ...

Published Date: Mar 16, 2026 (2 weeks, 3 days ago)

security.nl

Google meldde ten onrechte dat Chrome-lek was gedicht, rolt nieuwe update uit

Google heeft eerder deze week ten onrechte gemeld dat een actief aangevallen kwetsbaarheid in Chrome was verholpen, en heeft nu een nieuwe update uitgerold om gebruikers te beschermen. Op 12 maart waa ...

Published Date: Mar 14, 2026 (2 weeks, 4 days ago)

TheCyberThrone

CISA Adds Two Google Chrome Zero-Days to KEV

March 14, 2026CISA has updated its Known Exploited Vulnerabilities (KEV) catalog with two newly confirmed zero-days affecting Google Chrome — CVE-2026-3909 and CVE-2026-3910. Both vulnerabilities are ...

Published Date: Mar 14, 2026 (2 weeks, 5 days ago)

The Register

Google rushes Chrome update fixing two zero-days already under attack

Google has pushed out an emergency Chrome update to fix two previously unknown vulnerabilities that attackers were already exploiting before the patches landed. The bugs, tracked as CVE-2026-3909 and ...

Published Date: Mar 13, 2026 (2 weeks, 5 days ago)

The Hacker News

Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8

Google on Thursday released security updates for its Chrome web browser to address two high-severity vulnerabilities that it said have been exploited in the wild. The list of vulnerabilities is as fol ...

Published Date: Mar 13, 2026 (2 weeks, 5 days ago)

security.nl

Google komt met update voor actief aangevallen kwetsbaarheden in Chrome

Google heeft beveiligingsupdates uitgebracht voor twee actief aangevallen kwetsbaarheden in Chrome. Beide beveiligingslekken werden zelf door Google op 10 maart ontdekt. Het gaat om CVE-2026-3909 en C ...

Published Date: Mar 13, 2026 (2 weeks, 5 days ago)

CybersecurityNews

Chrome Zero-Day Vulnerabilities Actively Exploited in the Wild to Execute Malicious Code

Google has released an urgent security update for its Chrome browser after confirming that two high-severity zero-day vulnerabilities are being actively exploited in the wild. The stable channel has b ...

Published Date: Mar 13, 2026 (2 weeks, 5 days ago)

Daily CyberSecurity

Network Hijack: Critical 9.8 CVSS Flaw in AdGuard Home Grants Hackers Full DNS Control

AdGuard Home, the popular network-wide software used to silence ads and block trackers across entire households, is facing a serious security challenge. A critical vulnerability, tracked as CVE-2026-3 ...