Chrome Skia CVE-2026-3909: Exploited Out-of-Bounds Write

What to do

1. Confirm Chrome is at 146.0.7680.80 or any later version and Edge at 146.0.3856.62 or later; relaunch pending updates.
2. Remove fleet policies that pin or indefinitely defer browser updates.
3. Inventory Electron apps; require Electron 39.8.2, 40.8.2, 41.0.2 or newer and replace apps stuck on Electron 38 or older.
4. On Linux, update WebKitGTK and WPE WebKit to 2.54.0 or later, or move off distribution branches where they are end-of-life.
5. Ask kiosk, signage and appliance vendors whether their embedded browser includes the March 2026 Skia fix.

How to check if you are affected or compromised

• Check versions: chrome://version, edge://version, and the Chrome/ string inside Electron app binaries.
• On Linux, list WebKit packages with dpkg -l 'libwebkit2gtk*' 'libwpewebkit*' or rpm -qa | grep -i webkit.
• Google published no indicators of compromise as of Oct 23, 2026; for high-risk users, review endpoint telemetry from early March 2026 for browser processes spawning unexpected executables.

What happened#

On March 10, 2026, Google's Threat Analysis Group reported two Chrome bugs: CVE-2026-3909, an out-of-bounds write in the Skia graphics library, and CVE-2026-3910 in the V8 JavaScript engine. Google's March 12 Stable update (146.0.7680.75/76) first listed both. On March 13 Google corrected the post: "The previous version of these notes included CVE-2026-3909, the fix for which will instead be available in a future update." The Skia fix shipped that day in Chrome 146.0.7680.80, and Google said it "is aware that an exploit for CVE-2026-3909 exists in the wild." CISA added it to the KEV catalog on March 13, with a March 27 deadline.

The CVE record describes a crafted HTML page that triggers out-of-bounds memory access. It still says "prior to 146.0.7680.75". NVD uses the corrected boundary (before 146.0.7680.80) and scores it CVSS 3.1 8.8. Google has not disclosed technical details, the attacker or the targets as of Oct 23, 2026.

Who is affected#

• Chrome before 146.0.7680.80. The March 13 Chrome for Android release carries the same fixes.
• Microsoft Edge before 146.0.3856.62, released March 16.
• ChromeOS: fixed in Stable 16552.59.0 (March 13) and LTC-144 144.0.7559.246 (March 16).
• Electron backported the fix (Chromium bug 491421267) in 41.0.2, 40.8.2 and 39.8.2 on March 13. Electron 38 had no release after March 10, so 38 and older remain unfixed.
• WebKitGTK and WPE WebKit, which render with Skia. Their advisory WSA-2026-0006 (September 29, 2026) lists versions before 2.54.0 as affected.
• Linux packages: Debian fixed chromium in 146.0.7680.80 (DSA-6165-1). Bullseye's chromium is end-of-life and unfixed, and bookworm's webkit2gtk is also marked end-of-life and vulnerable.

Do you really need to act?#

For browsers, mostly no. Chrome, Edge and ChromeOS update themselves, and seven months on, current releases are far past these builds. Auto-updated users were exposed for days, not months.

Two groups still need a check. The first is anything that bundles its own Chromium: Electron apps on 38 or older or not rebuilt since mid-March, embedded browsers and lagging forks. The second is Linux desktops and devices using WebKitGTK or WPE WebKit, where the fix arrived only with 2.54.0 in late September. There is no public evidence that WebKitGTK was attacked. The exploitation Google reported was against Chrome.

What to do now#

1. Check browsers with chrome://version or google-chrome --version. Version 146.0.7680.80 or any later release is fixed. Edge needs 146.0.3856.62 or later.
2. In fleets, report browser versions centrally and remove policies that pin or indefinitely delay updates.
3. Inventory Electron apps. strings <app binary> | grep -m1 -oE "Chrome/[0-9.]+" usually shows the bundled Chromium. Require Electron 39.8.2, 40.8.2, 41.0.2 or newer.
4. On Linux, run dpkg -l 'libwebkit2gtk*' 'libwpewebkit*' or rpm -qa | grep -i webkit. Update to 2.54.0 or later, or move off branches where WebKit is end-of-life.
5. Ask kiosk, signage and appliance vendors whether their embedded browser includes the March 2026 Skia fix.

How to tell if you were hit#

Google has published no indicators of compromise. Real exposure was mostly Chrome users who browsed untrusted sites before updating around March 13–16, 2026. For high-risk users, review endpoint telemetry from early March 2026 for browser processes spawning unexpected executables or creating persistence, and escalate to forensics if anything stands out. CVE-2026-3910 was exploited in the same period, and the same browser updates cover it.

Timeline#

• Mar 10, 2026 — Google TAG reports the Skia bug.
• Mar 12, 2026 — Chrome 146.0.7680.75/76 ships, and the first release notes list CVE-2026-3909. The CVE is published.
• Mar 13, 2026 — Google corrects the notes and ships the fix in 146.0.7680.80. Electron, ChromeOS Stable and Android follow, and CISA adds the CVE to KEV.
• Mar 16, 2026 — Edge 146.0.3856.62 and ChromeOS LTC-144 ship the fix.
• Mar 27, 2026 — CISA's remediation deadline for federal agencies.
• Sep 29, 2026 — WebKitGTK and WPE WebKit list the CVE in WSA-2026-0006, fixed in 2.54.0.

Vulnerability records

• CVE-2026-3909 · KEV 2026-03-13 · Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Google Chrome Releases — Stable Channel Update for Desktop (Mar 13, 2026) chromereleases.googleblog.com
2. Google Chrome Releases — Stable Channel Update for Desktop (Mar 12, 2026, updated Mar 13) chromereleases.googleblog.com
3. CVE record — CVE-2026-3909 cve.org
4. NVD — CVE-2026-3909 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2026-3909 cisa.gov
6. Google Chrome Releases — Chrome for Android Update (Mar 13, 2026) chromereleases.googleblog.com
7. Google Chrome Releases — Stable Channel Update for ChromeOS (Mar 13, 2026) chromereleases.googleblog.com
8. Google Chrome Releases — Long Term Support Channel Update for ChromeOS (Mar 16, 2026) chromereleases.googleblog.com
9. Microsoft — Release notes for Microsoft Edge Security Updates learn.microsoft.com
10. Electron — Release v41.0.2 releases.electronjs.org
11. Electron — Release v40.8.2 releases.electronjs.org
12. Electron — Release v39.8.2 releases.electronjs.org
13. WebKitGTK and WPE WebKit — Security Advisory WSA-2026-0006 webkitgtk.org
14. Debian security tracker — CVE-2026-3909 security-tracker.debian.org

Coverage and analysis

1. BleepingComputer — Google fixes two new Chrome zero-days exploited in attacks bleepingcomputer.com
2. The Hacker News — Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8 thehackernews.com