---
title: "Chrome Skia CVE-2026-3909: Exploited Out-of-Bounds Write"
url: https://erroneo.us/security/briefs/chrome-skia-cve-2026-3909-out-of-bounds-write/
description: "Skia zero-day exploited against Chrome, fixed in 146.0.7680.80 in March 2026. Browsers auto-updated; check old Electron apps and WebKitGTK below 2.54.0."
type: security-brief
section: "Security Digest"
date_published: 2026-03-12
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-3909"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Chrome Skia CVE-2026-3909: Exploited Out-of-Bounds Write

**Verdict: Check exposure.** Auto-updating browsers were fixed in March 2026; what still needs checking is software carrying its own Skia, especially Electron 38 and older and WebKitGTK or WPE WebKit before 2.54.0.

- **Who must act:** Teams shipping or running Electron apps, embedded Chromium, Chromium forks, or Linux desktops and devices that use WebKitGTK or WPE WebKit, plus anyone with pinned browser versions.
- **Who can relax:** Users of auto-updating Chrome, Edge and ChromeOS that have updated since mid-March 2026.
- **Affected:** Google Chrome before 146.0.7680.80; Microsoft Edge before 146.0.3856.62; Electron 39 before 39.8.2, 40 before 40.8.2, 41 before 41.0.2; Electron 38 and older (no fix); WebKitGTK and WPE WebKit before 2.54.0; Debian 11 (bullseye) chromium (end-of-life, unfixed)
- **Fixed:** Google Chrome 146.0.7680.80 (Windows, Mac, Linux); Chrome for Android 146 release of Mar 13, 2026; Microsoft Edge 146.0.3856.62; ChromeOS Stable 16552.59.0 (browser 145.0.7632.216); LTC-144 144.0.7559.246; Electron 39.8.2, 40.8.2, 41.0.2; WebKitGTK and WPE WebKit 2.54.0; Debian chromium 146.0.7680.80 (DSA-6165-1)
- **CVEs:** CVE-2026-3909
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm Chrome is at 146.0.7680.80 or any later version and Edge at 146.0.3856.62 or later; relaunch pending updates.
2. Remove fleet policies that pin or indefinitely defer browser updates.
3. Inventory Electron apps; require Electron 39.8.2, 40.8.2, 41.0.2 or newer and replace apps stuck on Electron 38 or older.
4. On Linux, update WebKitGTK and WPE WebKit to 2.54.0 or later, or move off distribution branches where they are end-of-life.
5. Ask kiosk, signage and appliance vendors whether their embedded browser includes the March 2026 Skia fix.

### How to check if you are affected

- Check versions: chrome://version, edge://version, and the Chrome/ string inside Electron app binaries.
- On Linux, list WebKit packages with dpkg -l 'libwebkit2gtk*' 'libwpewebkit*' or rpm -qa | grep -i webkit.
- Google published no indicators of compromise as of Oct 23, 2026; for high-risk users, review endpoint telemetry from early March 2026 for browser processes spawning unexpected executables.

## What happened

On March 10, 2026, Google's Threat Analysis Group reported two Chrome bugs: CVE-2026-3909, an out-of-bounds write in the Skia graphics library, and CVE-2026-3910 in the V8 JavaScript engine. Google's [March 12 Stable update](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html) (146.0.7680.75/76) first listed both. On March 13 Google corrected the post: "The previous version of these notes included CVE-2026-3909, the fix for which will instead be available in a future update." The Skia fix shipped that day in [Chrome 146.0.7680.80](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html), and Google said it "is aware that an exploit for CVE-2026-3909 exists in the wild." CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3909) on March 13, with a March 27 deadline.

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-3909) describes a crafted HTML page that triggers out-of-bounds memory access. It still says "prior to 146.0.7680.75". [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-3909) uses the corrected boundary (before 146.0.7680.80) and scores it CVSS 3.1 8.8. Google has not disclosed technical details, the attacker or the targets as of Oct 23, 2026.

## Who is affected

- Chrome before 146.0.7680.80. The [March 13 Chrome for Android release](https://chromereleases.googleblog.com/2026/03/chrome-for-android-update_13.html) carries the same fixes.
- Microsoft Edge before 146.0.3856.62, released [March 16](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security).
- ChromeOS: fixed in Stable [16552.59.0](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-chromeos_13.html) (March 13) and LTC-144 [144.0.7559.246](https://chromereleases.googleblog.com/2026/03/long-term-support-channel-update-for_16.html) (March 16).
- Electron backported the fix (Chromium bug 491421267) in [41.0.2](https://releases.electronjs.org/release/v41.0.2), [40.8.2](https://releases.electronjs.org/release/v40.8.2) and [39.8.2](https://releases.electronjs.org/release/v39.8.2) on March 13. Electron 38 had no release after March 10, so 38 and older remain unfixed.
- WebKitGTK and WPE WebKit, which render with Skia. Their [advisory WSA-2026-0006](https://webkitgtk.org/security/WSA-2026-0006.html) (September 29, 2026) lists versions before 2.54.0 as affected.
- Linux packages: [Debian](https://security-tracker.debian.org/tracker/CVE-2026-3909) fixed chromium in 146.0.7680.80 (DSA-6165-1). Bullseye's chromium is end-of-life and unfixed, and bookworm's webkit2gtk is also marked end-of-life and vulnerable.

## Do you really need to act?

For browsers, mostly no. Chrome, Edge and ChromeOS update themselves, and seven months on, current releases are far past these builds. Auto-updated users were exposed for days, not months.

Two groups still need a check. The first is anything that bundles its own Chromium: Electron apps on 38 or older or not rebuilt since mid-March, embedded browsers and lagging forks. The second is Linux desktops and devices using WebKitGTK or WPE WebKit, where the fix arrived only with 2.54.0 in late September. There is no public evidence that WebKitGTK was attacked. The exploitation Google reported was against Chrome.

## What to do now

1. Check browsers with `chrome://version` or `google-chrome --version`. Version 146.0.7680.80 or any later release is fixed. Edge needs 146.0.3856.62 or later.
2. In fleets, report browser versions centrally and remove policies that pin or indefinitely delay updates.
3. Inventory Electron apps. `strings <app binary> | grep -m1 -oE "Chrome/[0-9.]+"` usually shows the bundled Chromium. Require Electron 39.8.2, 40.8.2, 41.0.2 or newer.
4. On Linux, run `dpkg -l 'libwebkit2gtk*' 'libwpewebkit*'` or `rpm -qa | grep -i webkit`. Update to 2.54.0 or later, or move off branches where WebKit is end-of-life.
5. Ask kiosk, signage and appliance vendors whether their embedded browser includes the March 2026 Skia fix.

## How to tell if you were hit

Google has published no indicators of compromise. Real exposure was mostly Chrome users who browsed untrusted sites before updating around March 13–16, 2026. For high-risk users, review endpoint telemetry from early March 2026 for browser processes spawning unexpected executables or creating persistence, and escalate to forensics if anything stands out. CVE-2026-3910 was exploited in the same period, and the same browser updates cover it.

## Timeline

- Mar 10, 2026 — Google TAG reports the Skia bug.
- Mar 12, 2026 — Chrome 146.0.7680.75/76 ships, and the first release notes list CVE-2026-3909. The CVE is published.
- Mar 13, 2026 — Google corrects the notes and ships the fix in 146.0.7680.80. Electron, ChromeOS Stable and Android follow, and CISA adds the CVE to KEV.
- Mar 16, 2026 — Edge 146.0.3856.62 and ChromeOS LTC-144 ship the fix.
- Mar 27, 2026 — CISA's remediation deadline for federal agencies.
- Sep 29, 2026 — WebKitGTK and WPE WebKit list the CVE in WSA-2026-0006, fixed in 2.54.0.

## Sources

1. [Google Chrome Releases — Stable Channel Update for Desktop (Mar 13, 2026)](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html)
2. [Google Chrome Releases — Stable Channel Update for Desktop (Mar 12, 2026, updated Mar 13)](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html)
3. [CVE record — CVE-2026-3909](https://www.cve.org/CVERecord?id=CVE-2026-3909)
4. [NVD — CVE-2026-3909](https://nvd.nist.gov/vuln/detail/CVE-2026-3909)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-3909](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3909)
6. [Google Chrome Releases — Chrome for Android Update (Mar 13, 2026)](https://chromereleases.googleblog.com/2026/03/chrome-for-android-update_13.html)
7. [Google Chrome Releases — Stable Channel Update for ChromeOS (Mar 13, 2026)](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-chromeos_13.html)
8. [Google Chrome Releases — Long Term Support Channel Update for ChromeOS (Mar 16, 2026)](https://chromereleases.googleblog.com/2026/03/long-term-support-channel-update-for_16.html)
9. [Microsoft — Release notes for Microsoft Edge Security Updates](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)
10. [Electron — Release v41.0.2](https://releases.electronjs.org/release/v41.0.2)
11. [Electron — Release v40.8.2](https://releases.electronjs.org/release/v40.8.2)
12. [Electron — Release v39.8.2](https://releases.electronjs.org/release/v39.8.2)
13. [WebKitGTK and WPE WebKit — Security Advisory WSA-2026-0006](https://webkitgtk.org/security/WSA-2026-0006.html)
14. [Debian security tracker — CVE-2026-3909](https://security-tracker.debian.org/tracker/CVE-2026-3909)
15. [BleepingComputer — Google fixes two new Chrome zero-days exploited in attacks](https://www.bleepingcomputer.com/news/google/google-fixes-two-new-chrome-zero-days-exploited-in-attacks/)
16. [The Hacker News — Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8](https://thehackernews.com/2026/03/google-fixes-two-chrome-zero-days.html)

---
Source page: https://erroneo.us/security/briefs/chrome-skia-cve-2026-3909-out-of-bounds-write/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt