CVE-2026-3909

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-3909 8.8

Google · Skia · Added 2026-03-13 · Published 2026-03-13

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityGoogle Skia Out-of-Bounds Write Vulnerability

VendorGoogle

ProductSkia

Date added2026-03-13

Due date2026-03-27

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-787

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Descriptions

KEV: Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

NVD: Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-28 17:45 UTC

Wall time45s

Searches8

Component defaultyes - Skia is the default 2D graphics rendering engine in Google Chrome, ChromeOS, Android, and Flutter; enabled in all Chromium-based browsers by default

Sources https://www.bleepingcomputer.com/news/google/google-fixes-two-new-chrome-zero-days-exploited-in-attacks/
https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html
https://securityaffairs.com/189411/security/u-s-cisa-adds-google-chrome-flaws-to-its-known-exploited-vulnerabilities-catalog.html
https://www.penligent.ai/hackinglabs/cve-2026-3909-poc-what-the-chrome-skia-zero-day-actually-gives-you/
https://windowsforum.com/threads/cisa-kev-adds-critical-skia-and-chromium-v8-flaws-cve-2026-3909-cve-2026-3910-patch-now.405045/
https://www.tenable.com/cve/CVE-2026-3909
https://www.securityweek.com/chrome-146-update-patches-two-exploited-zero-days/
https://github.com/advisories/GHSA-vmc5-xpp6-2j82
https://cvefeed.io/vuln/detail/CVE-2026-3909
https://github.com/jaf0rk/CVE-2026-3909
https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-chromeos_13.html
https://github.com/anansi2safe/CVE-2026-3909
https://thehackernews.com/2026/03/google-fixes-two-chrome-zero-days.html
https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html
https://nvd.nist.gov/vuln/detail/CVE-2026-3909

QC notes

warn component_extraction: Component 'Skia GrDrawOpAtlas::hasID() in SkChromeRemoteGlyphCache glyph cache operations (GPU-accelerated text rendering pipeline)' matches or contains product name 'Skia' — no specific component identified

Hunting hypothesis agent

Hunt Chrome GPU crash reports for EXCEPTION_ACCESS_VIOLATION in GrDrawOpAtlas::setLastUseToken (plotIndex 0x1f > fNumPlots 0x10) or libc++ abort in hasID; file at chrome://crashes or enterprise crash telemetry, stock logs lack GPU faults

Research details

ComponentSkia GrDrawOpAtlas::hasID() in SkChromeRemoteGlyphCache glyph cache operations (GPU-accelerated text rendering pipeline)

PreconditionsThe target must be running a Chromium-based browser (Google Chrome, Microsoft Edge, Brave, Opera, etc.) prior to version 146.0.7680.75, or another product embedding the vulnerable Skia library (ChromeOS, Android, Flutter). The user must visit a crafted HTML page that triggers the out-of-bounds write in Skia's 2D rendering pipeline. No additional user interaction beyond page visit is required (UI:R reflects user following a link or visiting a compromised site). The attacker must craft HTML/CSS content that exercises the vulnerable Skia code path, likely involving specific Skia glyph rendering operations. Exploitation results in memory corruption within the Chrome renderer process, which can lead to arbitrary code execution. Reported by Google Threat Analysis Group (TAG) as exploited in the wild as a zero-day before March 12, 2026. agent

DeliveryCrafted HTML page — the attacker hosts or injects a malicious HTML page that, when rendered by a vulnerable Chromium-based browser, triggers an out-of-bounds write in the Skia 2D graphics library's GrDrawOpAtlas glyph cache during GPU-accelerated text rendering. Delivery can occur through compromised websites, phishing emails with links, malvertising, or any vector where the victim loads attacker-controlled HTML/CSS content in their browser. The PoC patches SkChromeRemoteGlyphCache.cpp to inflate glyph plot allocations, then opens trigger.html to reproduce the crash in a real Chromium build.

Public PoCyes

PoC URLs https://github.com/anansi2safe/CVE-2026-3909 Third-party repos; verify before use.

Advisoryhttps://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html

Exploit notesCVSS v3.1 attack complexity: LOW (AC:L). The vulnerability is rated HIGH severity (CVSS 8.8) with impacts to Confidentiality, Integrity, and Availability all rated HIGH. However, user interaction is required (UI:R) via a crafted HTML page visit. The Chromium sandbox may limit the scope of code execution to the renderer process, though sandbox escape is possible with a separate vulnerability. The vulnerability was reported by Google TAG as actively exploited in the wild prior to patch. A public PoC (jaf0rk/CVE-2026-3909) patches SkChromeRemoteGlyphCache.cpp and raster_implementation.cc to inflate glyph plot allocations, then opens trigger.html to reproduce the crash: on Linux, libc++ hardening catches the OOB at GrDrawOpAtlas::hasID (plotIndex > fNumPlots); on Windows, GrDrawOpAtlas::setLastUseToken receives EXCEPTION_ACCESS_VIOLATION. The patch targets Skia's 2D Ganesh GPU text rendering pipeline, specifically the glyph cache plot allocation logic in SkChromeRemoteGlyphCache.

SummaryCVE-2026-3909 is an actively exploited high-severity (CVSS 8.8) out-of-bounds write vulnerability in Google's Skia 2D graphics library, the rendering engine embedded in Google Chrome, ChromeOS, Android, and Flutter. A remote attacker can trigger memory corruption and potentially achieve arbitrary code execution by luring a victim to a crafted HTML page. The vulnerability was fixed in Chrome 146.0.7680.75 released March 13, 2026 (and corresponding ChromeOS update). Google TAG reported in-the-wild exploitation as a zero-day. A public proof-of-concept exploit (anansi2safe/CVE-2026-3909) is available on GitHub. The CWE-787 (out-of-bounds write) defect resides in Skia's 2D rendering pipeline, likely involving glyph or font rendering operations. CISA added this to KEV on March 13, 2026, requiring mitigation by March 27, 2026. Products affected include Google Chrome (Windows, Mac, Linux), ChromeOS, Android (Skia library), and Flutter applications. Users of Chromium-based browsers (Edge, Brave, Opera) are also affected until their respective vendors ship the fix.

Tia coverage

First reported2026-06-09

First exploit report2026-06-09

Exploit report → KEV88 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

google-fixes-actively-exploited-android-zero-day-on-pixel-device google-patches-5th-chrome-zero-day-of-2026-cve-2026-11645-v8-eng

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.