high 8.8

CVE-2026-3909 kev in the critical feed json

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a…

published 2026-03-12 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-11734

cvss: 8.8; version 3.1, CNA
cisa kev: Exploited; added 2026-03-13
epss: 2.3%; EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits: 0; none known

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

fixed in 1 distros 7

google chrome 146.0.7680.80

debian red hat suse opensuse almalinux rocky linux alpine

chromium Debian 12 146.0.7680.80-1~deb12u1
chromium Debian 13 146.0.7680.80-1~deb13u1
chromium Debian 14 146.0.7680.80-1
wpewebkit Debian 14 2.54.0-1
webkit2gtk Debian 13 2.54.0-1~deb13u1

debian advisories DEBIAN-CVE-2026-3909

webkit2gtk3 RHEL 8 2.54.0-1.el8_10
webkit2gtk3-jsc RHEL 8 2.54.0-1.el8_10
webkit2gtk3 RHEL 9 2.54.0-1.el9_8
webkit2gtk3-jsc RHEL 9 2.54.0-1.el9_8

red hat advisories RHSA-2026:74084 RHSA-2026:69098

webkit2gtk3 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Desktop Applications 15 SP7 2.54.1-150600.12.81.3
webkit2gtk4 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Development Tools 15 SP7 +1 more 2.54.1-150600.12.81.4
webkit2gtk3-soup2 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Basesystem 15 SP7 2.54.1-150600.12.81.4
webkit2gtk3 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 2.54.1-150400.4.152.2
webkit2gtk4 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 2.54.1-150400.4.152.2
webkit2gtk3-soup2 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 2.54.1-150400.4.152.2
webkit2gtk3 SLES for SAP applications 16.0, SLES 16.0 2.54.1-160000.1.1
webkit2gtk4 SLES for SAP applications 16.0, SLES 16.0 2.54.1-160000.1.1

suse advisories SUSE-SU-2026:4858-1 SUSE-SU-2026:4676-1 SUSE-SU-2026:24225-1

webkit2gtk3 openSUSE Leap 16.0 2.54.1-160000.1.1
webkit2gtk4 openSUSE Leap 16.0 2.54.1-160000.1.1
webkit2gtk3-soup2 openSUSE Leap 16.0 2.54.1-160000.1.1
chromium openSUSE Leap 16.0 146.0.7680.177-bp160.1.1
chromium openSUSE Tumbleweed 146.0.7680.80-1.1

opensuse advisories openSUSE-SU-2026:22076-1 openSUSE-SU-2026:20460-1 openSUSE-SU-2026:10376-1

webkit2gtk3 AlmaLinux 8 2.54.0-1.el8_10
webkit2gtk3-jsc AlmaLinux 8 2.54.0-1.el8_10
webkit2gtk3 AlmaLinux 9 2.54.0-1.el9_8
webkit2gtk3-jsc AlmaLinux 9 2.54.0-1.el9_8

almalinux advisories ALSA-2026:74084 ALSA-2026:69098

webkit2gtk3 Rocky Linux 8 2.54.0-1.el8_10
webkit2gtk3 Rocky Linux 9 2.54.0-1.el9_8

rocky linux advisories RLSA-2026:74084 RLSA-2026:69098

qt6-qtwebengine Alpine 3.23 6.10.1-r10
qt6-qtwebengine Alpine 3.24 6.10.2-r8

alpine advisories ALPINE-CVE-2026-3909

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-3909 updated 2026-11-05 cvss 8.8

chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia

Red Hat Enterprise Linux 6 webkitgtk
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) webkit2gtk3 2.54.0-1.el8_10, webkit2gtk3-jsc 2.54.0-1.el8_10
fixed: vendor fix RHSA-2026:74084
Red Hat Enterprise Linux AppStream (v. 9) webkit2gtk3 2.54.0-1.el9_8, webkit2gtk3-jsc 2.54.0-1.el9_8
fixed: vendor fix RHSA-2026:69098
Red Hat Enterprise Linux AppStream AUS (v.8.4) webkit2gtk3 2.54.0-1.el8_4, webkit2gtk3-jsc 2.54.0-1.el8_4
fixed: vendor fix RHSA-2026:95403
Red Hat Enterprise Linux AppStream AUS (v.8.6) webkit2gtk3 2.54.0-1.el8_6, webkit2gtk3-jsc 2.54.0-1.el8_6
fixed: vendor fix RHSA-2026:92339
Red Hat Enterprise Linux AppStream E4S (v.8.8) webkit2gtk3 2.54.0-1.el8_8, webkit2gtk3-jsc 2.54.0-1.el8_8
fixed: vendor fix RHSA-2026:93435
Red Hat Enterprise Linux AppStream E4S (v.9.2) webkit2gtk3 2.54.0-1.el9_2, webkit2gtk3-jsc 2.54.0-1.el9_2
fixed: vendor fix RHSA-2026:89822
Red Hat Enterprise Linux AppStream E4S (v.9.4) webkit2gtk3 2.54.0-1.el9_4, webkit2gtk3-jsc 2.54.0-1.el9_4
fixed: vendor fix RHSA-2026:92216

show 5 more

Red Hat Enterprise Linux AppStream EUS (v.9.6) webkit2gtk3 2.54.0-1.el9_6, webkit2gtk3-jsc 2.54.0-1.el9_6
fixed: vendor fix RHSA-2026:89821
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) webkit2gtk3 2.54.0-1.el8_4, webkit2gtk3-jsc 2.54.0-1.el8_4
fixed: vendor fix RHSA-2026:95403
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) webkit2gtk3 2.54.0-1.el8_6, webkit2gtk3-jsc 2.54.0-1.el8_6
fixed: vendor fix RHSA-2026:92339
Red Hat Enterprise Linux AppStream TUS (v.8.8) webkit2gtk3 2.54.0-1.el8_8, webkit2gtk3-jsc 2.54.0-1.el8_8
fixed: vendor fix RHSA-2026:93435
Red Hat Enterprise Linux 7 firefox, webkitgtk3, webkitgtk4, libwebkit2gtk, webkitgtk4-jsc, webkitgtk4-plugin-process-gtk2 Red Hat Enterprise Linux 8 firefox Red Hat Enterprise Linux 9 firefox, firefox-x11 Red Hat Enterprise Linux 10 firefox
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2026-03-12 0-day patched (Project Zero)
2026-03-12 Published
2026-03-13 CISA SSVC: exploitation active
2026-03-13 Added to CISA KEV
2026-03-27 CISA patch deadline

Known exploited

Added: 7 mo ago (2026-03-13)
Patch by: 2026-03-27 (7 mo ago)
Ransomware: Not known
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product: Google, Skia
CISA name: Google Skia Out-of-Bounds Write Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Patched: 2026-03-12
Details: project zero tracker

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 7 mo ago (2026-03-13)

Exploit prediction

2.33% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Google Chrome

Classification

Weakness

CWE-787 Out-of-bounds Write

Technology feeds

Google Chrome rss critical rss

References

chromereleases.googleblog.com /2026/03/stable-channel-update-for-desktop_13.html
release-notes, vendor-advisory
issues.chromium.org /issues/491421267
permissions-required
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3909
government-resource, us-government-resource

Sources

CVE List CVE-2026-3909
NVD CVE-2026-3909

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary