CVE-2026-3909: Google Skia out-of-bounds write in Google Chrome

CVE-2026-3909 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2026-03-13

Google Skia, a graphics engine used in web browsers and mobile operating systems, contains a critical security flaw that allows attackers to corrupt system memory. By tricking a user into visiting a specially crafted website, an attacker could potentially execute malicious code or crash the application. This vulnerability is particularly serious as it has been observed being used in active attacks in the wild.

Technologies: Google Android, Google Chrome, Google ChromeOS, Google Skia. Vendors: Google.

Quick answers

Is CVE-2026-3909 exploited in the wild?
Yes. CVE-2026-3909 is known to be exploited in the wild, first recorded on 13 March 2026. Treat it as urgent.
How severe is CVE-2026-3909?
Critical severity, with a CVSS score of 8.8, published 13 March 2026.
Which products and versions are affected?
Google Chrome prior to 146.0.7680.75; Google Skia prior to 146.0.7680.75.
Is there a fix for CVE-2026-3909?
A patch was published on 2026-03-13: Fixed in Chrome 146.0.7680.75 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3909 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-3909?
Check whether you run Google Android, Google Chrome, Google ChromeOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) write vulnerability (CWE-787) exists in the Skia graphics library as integrated into Google Chrome and other products. The flaw is triggered when the engine processes a specially crafted HTML page, leading to unauthorized memory access. This is a remote attack vector that requires minimal user interaction (visiting a URL) and no prior authentication. Successful exploitation can lead to arbitrary code execution within the context of the browser renderer process or a denial-of-service condition. Google has released patches in Chrome version 146.0.7680.75 and later to address this issue.

Affected products

  • Google Skia prior to 146.0.7680.75
  • Google Chrome prior to 146.0.7680.75
  • Google ChromeOS
  • Google Android
  • Google Flutter

Timeline

  • 2026-03-13: disclosed
  • 2026-03-13: advisory
  • 2026-03-13: kev added: Added to CISA KEV catalog due to active exploitation.
  • 2026-03-13: patched: Fixed in Chrome 146.0.7680.75

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.