Google Skia Out-of-Bounds Write Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 13, 2026 · Catalog

   Detected

   Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

2. Mar 13, 2026 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. Mar 27, 2026 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Jun 17, 2026 · Catalog

   Updated

   Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

5. Jun 17, 2026 · NIST NVD

   Updated

   Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Affected

• cpe google/chromeversion unspecified
• vendor Google Skiaversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2026-3909

  Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

  cisa.gov
• CVE.orgVulnerability recordCVE-2026-3909

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-3909

  30-day exploitation probability 2.3%

  first.org
• NIST NVDVulnerability recordCVE-2026-3909

  Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

  nvd.nist.gov

References

• CISA note · chromereleases.googleblog.com
• Permissions Required · issues.chromium.org
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov