What is the CVSS score of CVE-2026-3909?

CVE-2026-3909 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-3909?

Yes, a public proof-of-concept exploit is available for CVE-2026-3909. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-3909?

Within 24 hours: Issue mandatory Chrome update notification to all users and block access to Chrome versions prior to 146.0.7680.75 at the network level if possible. Within 7 days: Verify 100% patching completion through endpoint management tools and conduct spot-check audits on critical user populations. Within 30 days: Review browser usage logs for exploitation indicators, assess any suspicious endpoint behavior during the vulnerability window, and implement browser update enforcement policies to prevent future exploitation delays.

Chrome CVE-2026-3909

HIGH

Out-of-bounds Write (CWE-787)

2026-03-13 chrome-cve-admin@google.com

Buffer Overflow Chrome Google Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious HTML page
Exploit

User visits page in Chrome browser
Execution

Trigger out of bounds write in Skia renderer
Impact

Execute arbitrary code with Chrome process privileges

Vulnerability Assessment

Weakness	CWE CWE-787 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	User must click or visit attacker-controlled webpage in Google Chrome versions prior to 146.0.7680.75. No authentication or special configuration required; default Chrome installation vulnerable.
Impact	CVSS 8.8 (High). KEV-listed — actively exploited. Public PoC available. Patch available in Chrome 146.0.7680.75. Affects all Chromium-based browsers. Drive-by exploitation — user just needs to visit a page.
Exploit ScenarioDerived	An attacker creates a webpage containing crafted SVG, Canvas, or other graphical elements that trigger the Skia out-of-bounds write when rendered. Any user visiting the page in an unpatched Chrome-based browser triggers the vulnerability, enabling code execution within the renderer sandbox. This can be delivered through compromised ad networks (malvertising) for mass exploitation or through targeted phishing links.

Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 13, 2026

Google Chrome's Skia graphics library contains an out-of-bounds write (CVE-2026-3909, CVSS 8.8) enabling remote attackers to perform memory corruption through crafted HTML pages. KEV-listed with public PoC and patches available, this vulnerability in the core graphics rendering engine affects all Chromium-based browsers.

Earlier versions of this analysis (1)

v1 Mar 13, 2026 - 20:00 CVSS 8.8

Skia, Chrome's 2D graphics library, contains an out-of-bounds write (CWE-787) triggered during rendering of crafted graphical content, enabling heap memory corruption and potential code execution within the renderer sandbox.

RemediationAI

Update Chrome to 146.0.7680.75+ immediately. Update all Chromium-based browsers. Ensure auto-update is enabled organization-wide.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Skia handles all 2D graphics rendering in Chrome, including text, images, SVG, and Canvas operations. The out-of-bounds write occurs when processing specific graphical primitives, allowing an attacker to corrupt heap memory in the renderer process. This vulnerability is in a low-level graphics component that processes all visual content, making it triggerable through any webpage.

Know when Chrome gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD HIGH

SUSE HIGH

Red Hat 8.8 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Mar 25, 2026 - 14:05 cisa

CISA KEV

PoC Detected

Mar 25, 2026 - 14:05 vuln.today

Public exploit code

Patch released

Mar 25, 2026 - 14:05 nvd

Patch available

CVE Published

Mar 13, 2026 - 19:55 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

POC CVE-2026-3909: Chromium Skia Atlas Out-of-Bounds PoC Apr 13, 2026

Executive ViewAI

Why It Matters

CVE-2026-3909 is an actively exploited vulnerability in Google Chrome's Skia graphics library that allows attackers to execute arbitrary code on user systems through malicious webpages. All Chrome users in the organization are at immediate risk of compromise with only a webpage visit required to trigger the attack, making rapid patching critical to prevent data breach, ransomware deployment, and business disruption.

Business Impact: High

Compensating Controls

Apply vendor patch. Immediately update Chrome to version 146.0.7680.75 or later. If immediate patching is not feasible, temporarily restrict Chrome usage to internal networks only and disable JavaScript execution for untrusted content via Group Policy or Mobile Device Management until patches are deployed.

Threat Intelligence Overview

Threat Score

4.8/10

Composite threat intelligence

EPSS Score

0.1%

Top 79% exploitable

Threat Intel

1 source

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

NVD

CVE.org

CISA KEV

EPSS NCSC-NL Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV Yes

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

119

Low Medium High Critical

KEV: +50

EPSS: 0

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: +5

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.