CVE-2026-3909

Overview

CVE-2026-3909 is an out-of-bounds write vulnerability in Skia, the open-source 2D graphics library used by Google Chrome and numerous other products. A remote attacker can exploit this flaw by luring a victim to a crafted HTML page, triggering out-of-bounds memory access in the Skia rendering engine. Successful exploitation can lead to arbitrary code execution in the context of the browser process.

Skia is a widely shared open-source component used across Google Chrome, ChromeOS, Android, Flutter, Mozilla Firefox, and many other applications. CISA's KEV listing explicitly notes: "This vulnerability affects a common open-source component, third-party library, or a protocol used by different products." The blast radius extends well beyond Chrome alone.

Vulnerability Description

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Skia is an open-source 2D graphics library that serves as the primary rendering engine for Google Chrome, ChromeOS, Android, and Flutter. It handles operations such as rasterization, text rendering, path geometry, image decoding, and GPU-accelerated drawing.

The out-of-bounds write occurs when Skia processes specially crafted graphical content embedded in an HTML page. An attacker can craft a malicious web page that, when visited by a victim, triggers the OOB write during rendering. This can corrupt adjacent memory, potentially allowing the attacker to:

• Execute arbitrary code in the context of the Chrome renderer process
• Escape the renderer sandbox when combined with additional exploits
• Achieve full system compromise in chained exploitation scenarios
• Steal sensitive data from the victim's browsing session

The attack requires only that the victim navigate to a malicious page — no additional user interaction is needed beyond clicking a link. This makes it ideal for phishing campaigns, watering hole attacks, and malvertising.

Skia: Shared Open-Source Component

CISA's KEV entry includes an important note: this vulnerability affects a common open-source component used by different products. Skia is embedded in far more than just Google Chrome:

Products Using Skia

Affected Products & Versions

Google Chrome

Other Affected Products

Impact

Remediation

Immediate Actions

1. Update Google Chrome to version 146.0.7680.80 or later (Windows/Mac) or 146.0.7680.75 or later (Linux)
2. Update Chromium-based browsers — Microsoft Edge, Brave, Opera, Vivaldi, and others will release corresponding patches
3. Update Electron-based applications — check for updates to apps built on Electron/Chromium
4. Verify auto-update — navigate to chrome://settings/help to confirm Chrome is on the latest version
5. Audit Skia usage — if your organization develops software using Skia or SkiaSharp, update the Skia dependency

Mitigations (if patching is delayed)

• Enable Chrome's Site Isolation (enabled by default) to limit the impact of renderer exploits
• Use browser security policies to restrict navigation to untrusted sites
• Deploy web filtering to block known malicious domains
• Consider disabling JavaScript on untrusted sites via browser extensions