CVE-2026-3909
Published: 13 March 2026
Summary
CVE-2026-3909 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 36.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identifying, prioritizing, and remediating known flaws like the out-of-bounds write in Chrome's Skia library by applying patches such as version 146.0.7680.75.
Implements memory protection methods such as stack canaries, ASLR, and DEP that directly mitigate exploitation of out-of-bounds writes in Skia during HTML processing.
Vulnerability scanning detects systems running vulnerable Chrome versions affected by this Skia out-of-bounds write, enabling targeted remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in Chrome's Skia library exploited via crafted HTML on malicious website enables drive-by compromise (T1189) and client-side exploitation for code execution (T1203).
NVD Description
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2026-3909 is an out-of-bounds write vulnerability in the Skia graphics library used by Google Chrome versions prior to 146.0.7680.75. This flaw, classified under CWE-787, enables out-of-bounds memory access when processing a crafted HTML page. Chromium security teams rated it as High severity, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website containing the crafted HTML page, as it requires user interaction but no special privileges. Successful exploitation allows the attacker to achieve high-impact effects on confidentiality, integrity, and availability, potentially leading to arbitrary code execution or system compromise within the browser's sandbox.
Google's Chrome Releases blog details a stable channel update to version 146.0.7680.75 that addresses this issue. The vulnerability is tracked in the Chromium issue tracker at issues.chromium.org/issues/491421267. Mitigation involves updating to the patched version, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed it in its Known Exploited Vulnerabilities Catalog.
This CVE appears in CISA's Known Exploited Vulnerabilities Catalog, indicating real-world exploitation by threat actors.
Details
- CWE(s)
- KEV Date Added
- 13 March 2026