CVE-2026-3909CISA KEV
Google Skia Out-of-Bounds Write Vulnerability
CISA lists this Google Skia vulnerability as known exploited. The vendor's advisory has the fixed versions.
CISA catalog record
Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
- Product
- Skia
- Added to KEV
- 13 Mar 2026
- Federal remediation due
- 27 Mar 2026
- Known ransomware use
- Not reported