CISA Known Exploited Vulnerability
This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.
Remediation Deadline: Mar 27, 2026
Description
Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
EPSS — Exploit Probability
Higher than 89.0% of all CVEs
Required Action
This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html#:~:text=Google%20is%20aware ; https://nvd.nist.gov/vuln/detail/CVE-2026-3909
Related Articles (6)
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
Mar 13, 2026
Google fixes two new Chrome zero-days exploited in attacks
Google has released emergency security updates to patch two high-severity Chrome vulnerabilities exploited in zero-day attacks.
Mar 13, 2026
Chrome 146 Update Patches Two Exploited Zero-Days
The flaws can be exploited to manipulate data and bypass security restrictions, potentially leading to code execution.
Mar 13, 2026
Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8
Google patches two Chrome zero-days exploited in the wild, urging updates to version 146.0.7680.75/76 to prevent attacks.
Mar 13, 2026
⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More
Catch up on the latest cyber threats, attack trends, security research, botnets, phishing, and critical vulnerabilities.
Mar 16, 2026
Chrome 146 Update Patches High-Severity Vulnerabilities
The software refresh fixes eight memory safety bugs affecting seven Chrome components.
Mar 24, 2026
Risk Assessment
ELEVATEDDetails
- Severity
- High
- EPSS
- 4.4%
- CISA KEV
- Yes
- Ransomware
- Unknown
- Articles
- 6
Timeline
Published
Mar 13, 2026
Added to KEV
Mar 13, 2026
Remediation Due
Mar 27, 2026