CVE-2026-3909

This is a bug in the browser’s graphics engine (Skia) where a malicious web page can cause the browser to write to memory it shouldn’t. In the worst case, this can let an attacker gain control; more commonly it can make the browser crash. Think of it like a software “ink spill” when rendering a webpage—if it’s bad enough, it can damage the browser in a way that attackers can potentially leverage.

This affects you if your organization uses Google Chrome (and the related browser ecosystem listed here), especially on systems that browse the public internet normally. The attacker does not need a special account, but they do need a user to open a crafted webpage. Risk is highest when users can visit untrusted or random websites (i.e., the vulnerable browser version is reachable during normal web browsing); only a risk under those “user browsing a malicious page” conditions.

This is a RED issue because it is confirmed in CISA KEV, meaning it has been identified as a real security risk that defenders must address. While this specific item has no clear dated public report of active attacks in the provided text, the KEV listing and its confirmed relevance drive immediate action to prevent user-driven triggering via malicious webpages.

1. Identify exposure

   • On each affected workstation/server, open the browser “About” page and record the version for Google Chrome and Microsoft Edge.
   • If the version is earlier than 146.0.7680.75, you are exposed for CVE-2026-3909.

2. Upgrade to the fixed version

   • Upgrade Google Chrome to 146.0.7680.75 or later.
   • If your environment only offers the next available build, use 146.0.7680.80 or later.
   • Re-check the version after upgrade to confirm it changed.

3. If you cannot patch right away

   • Reduce the chance users will trigger the bug by blocking or discouraging access to untrusted sites (phishing links, unknown domains, newly created sites).
   • Increase scrutiny of email/web links and temporarily restrict high-risk browsing paths for impacted users.

4. What to monitor

   • After update, watch for unusual browser crashes or sudden spike in browser restarts on endpoints.
   • If you use endpoint detection, look for alerts tied to browser exploitation patterns or abnormal process behavior originating from the browser shortly after users visited new/untrusted pages.

5. Follow CISA guidance timing

   • CISA KEV due date for remediation is 2026-03-27; prioritize completing upgrades before that date.

Severity is High with a reported CVSS of 8.8 (Attack Vector: Network; Privileges Required: None; User Interaction: Required; impact includes potential confidentiality, integrity, and availability effects). The weakness is CWE-787 (out-of-bounds write). Mechanism: a crafted HTML page can trigger an out-of-bounds memory write in Skia (Chrome’s graphics engine), which may lead to remote memory corruption—potentially enabling denial of service and, in worst cases, control-flow or code execution.

KEV status: CVE-2026-3909 is listed in the CISA KEV catalog (added 2026-03-13) with remediation due 2026-03-27, meaning it is considered a known, addressable risk by defenders.

Exploitation maturity: The provided sources do not include a dated claim of active exploitation specifically for this CVE, and no public exploit code was found in the provided material. However, KEV inclusion indicates it is not purely theoretical.

EPSS: a prediction was provided (1.6% with flat trend), but KEV takes precedence for urgency in this case.

Actor note (from PULSE): actor UNC6240 (ShinyHunters) is associated in the provided dataset, which further supports treating this as a serious, actionable item.