What is the CVSS score of CVE-2026-3909?

CVE-2026-3909 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Chrome are affected by CVE-2026-3909?

CVE-2026-3909 is an actively exploited vulnerability in Google Chrome's Skia graphics library that allows attackers to execute arbitrary code on user systems through malicious webpages.. A patch is available.

Is there a public PoC exploit available for CVE-2026-3909?

Yes, a public proof-of-concept exploit is available for CVE-2026-3909. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-3909?

Within 24 hours: Issue mandatory Chrome update notification to all users and block access to Chrome versions prior to 146.0.7680.75 at the network level if possible. Within 7 days: Verify 100% patching completion through endpoint management tools and conduct spot-check audits on critical user populations. Within 30 days: Review browser usage logs for exploitation indicators, assess any suspicious endpoint behavior during the vulnerability window, and implement browser update enforcement policies to prevent future exploitation delays.

Chrome CVE-2026-3909

HIGH

Out-of-bounds Write (CWE-787)

2026-03-13 chrome-cve-admin@google.com

Buffer Overflow Chrome Google Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Mar 25, 2026 - 14:05 cisa

CISA KEV

PoC Detected

Mar 25, 2026 - 14:05 vuln.today

Public exploit code

Patch released

Mar 25, 2026 - 14:05 nvd

Patch available

Analysis Generated

Mar 13, 2026 - 20:00 vuln.today

CVE Published

Mar 13, 2026 - 19:55 nvd

HIGH 8.8

DescriptionCVE.org

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

POC CVE-2026-3909: Chromium Skia Atlas Out-of-Bounds PoC Apr 13, 2026

AnalysisAI

Google Chrome's Skia graphics library contains an out-of-bounds write (CVE-2026-3909, CVSS 8.8) enabling remote attackers to perform memory corruption through crafted HTML pages. KEV-listed with public PoC and patches available, this vulnerability in the core graphics rendering engine affects all Chromium-based browsers.

Technical ContextAI

Skia handles all 2D graphics rendering in Chrome, including text, images, SVG, and Canvas operations. The out-of-bounds write occurs when processing specific graphical primitives, allowing an attacker to corrupt heap memory in the renderer process. This vulnerability is in a low-level graphics component that processes all visual content, making it triggerable through any webpage.