Vulnerability intelligence
CVE-2026-3909
Google Skia Out-of-Bounds Write Vulnerability
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score
—
Unrated
EPSS — Exploit Probability
2.3%
Riskier than 83% of all CVEs · checked 2026-10-19
Exploitation
Confirmed in the wild
KEV since 2026-03-13
Remediation
Patch available
Federal deadline 2026-03-27
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-27.
12 articles across 5 outlets · first covered Mar 13, 2026 · latest Sep 9, 2026
Coverage timeline
-
Google Patches Chrome’s Seventh Zero Day of 2026 Under Attacksecurityaffairs.com · Sep 9, 2026
-
Chrome Patches Exploited V8 Zero Day Allowing Code Executionthehackernews.com · Sep 9, 2026
-
CISA Flags Actively Exploited Chrome Flaw as Sixth 2026 Zero-Daysecurityaffairs.com · Sep 4, 2026
-
Google Patches Actively Exploited Chrome V8 Zero Daysecurityaffairs.com · Sep 4, 2026
-
Google Patches Chrome Zero Day Exploited in V8 Attacksthehackernews.com · Sep 4, 2026
-
⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & Morethehackernews.com · Mar 16, 2026
-
U.S. CISA adds Google Chrome flaws to its Known Exploited Vulnerabilities catalogsecurityaffairs.com · Mar 13, 2026
-
CISA Adds CVE-2026-3909 to Known Exploited Vulnerabilities Cataloguewww.cisa.gov · Mar 13, 2026
-
CISA Adds CVE-2026-3909 to Known Exploited Vulnerabilities Cataloguecisa.gov · Mar 13, 2026
-
Google fixed two new actively exploited flaws in the Chrome browsersecurityaffairs.com · Mar 13, 2026
-
Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8thehackernews.com · Mar 13, 2026
-
Chrome 146 Update Patches Two Exploited Zero-Dayswww.securityweek.com · Mar 13, 2026