CVE DatabaseCVE-2026-3909

Updated 2026-06-17한국어 권고문 →

CVE-2026-39098.8/HIGHCISA KEVCWE-787CWE-787

Google Chrome Skia Graphics Engine Out-of-bounds Write Vulnerability (CVE-2026-3909) Technical Advisory

⚡ Jump to Patch

Affected Vendors

google

Affected Components

chrome, chromium

Published Date

2026-03-13

CVSS v3.1

8.8

HIGH

EPSS (30d)

2.3%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Google Chrome and Chromium-based browsers prior to version 146.0.7680.75

Impact

Remote attackers can execute arbitrary code or cause a denial of service (system crash) via a crafted HTML page

Mitigation

Immediately update Google Chrome to the latest stable version (146.0.7680.75 or higher)

Affected Products & Version Scope

Google Chrome prior to version 146.0.7680.75 (All platforms: Windows, macOS, Linux)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

To upgrade Google Chrome to the patched version on Linux systems, execute the following commands:

bash

# Update package repositories and upgrade Google Chrome
sudo apt-get update && sudo apt-get --only-upgrade install google-chrome-stable -y

# Verify the installed version
google-chrome --version

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, enforce strict application sandboxing and restrict access to untrusted external sites using system policies.

powershell

# Enforce Chrome Sandbox via Windows Registry Policy
New-Item -Path 'HKLM:\SOFTWARE\Policies\Google\Chrome' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Google\Chrome' -Name 'SandboxState' -Value 1 -PropertyType DWord -Force

3. Log Audit & IoC Verification Commands

Use the following PowerShell script to audit enterprise endpoints and identify vulnerable Chrome installations.

powershell

# Audit script to detect vulnerable Chrome versions
$chromePath = '${env:ProgramFiles}\Google\Chrome\Application\chrome.exe'
if (Test-Path $chromePath) {
    $version = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($chromePath).FileVersion
    $patchedVersion = [version]'146.0.7680.75'
    if ([version]$version -lt $patchedVersion) {
        Write-Error 'VULNERABLE: Chrome version '$version' detected. Upgrade to 146.0.7680.75 or higher immediately.'
    } else {
        Write-Host 'SECURE: Chrome version '$version' is patched.' -ForegroundColor Green
    }
} else {
    Write-Host 'Chrome is not installed in the default path.'
}

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Due to active in-the-wild exploitation, immediately update all Google Chrome installations to version 146.0.7680.75 or later.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2026-3909) is an out-of-bounds write (CWE-787) in the Skia 2D graphics library utilized by Google Chrome and Chromium. The root cause lies in insufficient boundary validation when rendering complex graphical elements, fonts, or canvas objects, allowing memory operations to write data outside the allocated buffer limits.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by hosting a malicious website containing specially crafted HTML and JavaScript designed to trigger anomalous rendering behavior in Skia. When a victim visits the page, the rendering engine processes the malformed graphical data, leading to heap corruption. This corruption can be leveraged to bypass browser memory protections and hijack the control flow of the renderer process.

3. Infrastructure & Business Impact

As this vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, active exploitation in the wild has been confirmed. Successful exploitation allows remote code execution (RCE) within the context of the browser's sandbox. If chained with a sandbox escape vulnerability, it poses a critical threat, potentially leading to full endpoint compromise and lateral movement within corporate networks.

Official Vendor Advisories & References

NVD Original English Description

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html

Source: chrome-cve-admin@google.com · Release Notes, Vendor Advisory

https://issues.chromium.org/issues/491421267

Source: chrome-cve-admin@google.com · Permissions Required

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3909

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2026-3909)

FAQ

Q1. How critical is CVE-2026-3909 and is it actively exploited in the wild?

CVE-2026-3909 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 2.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2026-3909?

Primary impacted vendors include google across chrome, chromium. Scope summary: Google Chrome prior to version 146.0.7680.75 (All platforms: Windows, macOS, Linux)

Q3. What temporary mitigations or workarounds exist for CVE-2026-3909 before patching?

[Mitigation] Immediately update Google Chrome to the latest stable version (146.0.7680.75 or higher) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION