CVE-2026-3909: Out-of-Bounds Write in Google Skia Exposes Chrome, Android, and Flutter to Remote Code Execution

CVE ID: CVE-2026-3909 Vendor: Google Affected Products: Google Chrome, ChromeOS, Android, Flutter CISA KEV Patch Deadline: 2026-03-27

Vulnerability Overview

CVE-2026-3909 is an out-of-bounds write vulnerability residing in Google Skia, the open-source 2D graphics rendering engine that underpins Chrome, ChromeOS, Android, and Flutter. The flaw allows a remote, unauthenticated attacker to trigger memory writes outside the boundaries of an allocated buffer by delivering a specially crafted HTML page to a target.

The attack vector is the browser itself. No user interaction beyond visiting or rendering a malicious page is required to trigger the memory corruption. Skia processes graphical content as part of normal page rendering, meaning the vulnerability sits directly in the critical rendering path of every affected product.

Technical Details

Vulnerability class: Out-of-bounds write (CWE-787) Attack vector: Network (remote, via crafted HTML) Authentication required: None User interaction: Required (victim must load or be redirected to malicious content)

The flaw originates in Skia's handling of malformed graphical or layout data embedded within an HTML page. When the renderer processes the malformed input, it writes data beyond the allocated memory region. Out-of-bounds writes of this class commonly provide primitives for heap corruption, enabling an attacker to overwrite adjacent memory structures, corrupt function pointers, or achieve controlled code execution depending on allocator behavior and exploit reliability.

Because Skia is a shared dependency across multiple Google platforms, the attack surface extends beyond the desktop browser. Android devices running Chrome-based rendering, ChromeOS systems, and applications built with Flutter that render HTML or web content are all exposed to the same underlying flaw.

Real-World Impact

Successful exploitation of CVE-2026-3909 can result in arbitrary remote code execution within the context of the Chrome renderer process. Depending on sandbox escape capability, an attacker could move from renderer-level execution toward broader system compromise.

The exploitation scenario requires no elevated privileges on the attacker's side. Hosting a malicious webpage, injecting content via a compromised ad network, or conducting a watering hole attack are all viable delivery mechanisms. The victim population is large: Chrome holds a dominant share of global browser usage, Android is the world's most widely deployed mobile operating system, and Flutter powers a significant number of cross-platform applications.

CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog, mandating that all U.S. federal civilian executive branch agencies apply patches by 2026-03-27. Inclusion in the KEV catalog reflects confirmed or high-confidence exploitation activity in the wild.

Enterprises running managed Chrome deployments, Android device fleets, or internally developed Flutter applications face direct exposure. SOC teams should treat unpatched endpoints as high-risk assets from the date of advisory publication.

Affected Products and Versions

  • Google Chrome — all versions prior to Google's remediation release
  • ChromeOS — all versions prior to Google's remediation release
  • Android — devices receiving Chrome or WebView updates via affected Skia builds
  • Flutter — applications that depend on vulnerable Skia versions

Organizations using Chromium-based browsers (Microsoft Edge, Brave, Opera) should monitor their respective vendor advisories, as those products also embed Skia and may ship independent patch timelines.

Patching and Mitigation Guidance

1. Apply Google patches immediately upon release. Update Chrome via the browser's built-in update mechanism or through enterprise management tools (Google Admin Console, Microsoft Intune, or equivalent MDM solutions). Verify the installed Chrome version against Google's published fixed-version advisory.

2. Update Android devices. Push Android security updates across managed device fleets. For unmanaged or BYOD environments, enforce patch compliance policy. Android WebView, which also uses Skia, must be updated independently through the Play Store.

3. Audit Flutter application dependencies. Developers maintaining Flutter applications must update the Flutter SDK and rebuild and redeploy affected applications. End users of Flutter apps cannot self-remediate; the fix must come from the application publisher.

4. Enable and monitor EDR/XDR telemetry on Chrome processes. Configure endpoint detection tools to flag anomalous behavior originating from Chrome renderer processes, including unexpected child process spawning, memory access violations, and unusual network connections initiated by renderer-level processes.

5. Review web proxy and DNS logs. Identify endpoints that may have reached known malicious domains delivering exploit payloads. Correlate with any Chrome crash reports or renderer instability logged in your environment during the exposure window.

6. Enforce Safe Browsing and content filtering. Google Safe Browsing and enterprise web filtering solutions can reduce exposure by blocking access to known malicious URLs. This is a defense-in-depth measure and does not substitute for patching.

7. Federal agencies must treat the 2026-03-27 CISA deadline as a hard requirement. Agencies that cannot patch by the deadline must document a compensating control and report status per BOD 22-01 requirements.

Summary Table

| Field | Detail | |---|---| | CVE | CVE-2026-3909 | | CVSS | Pending official publication | | Vulnerability Type | Out-of-Bounds Write (CWE-787) | | Attack Vector | Remote, via crafted HTML | | Impact | Remote Code Execution | | Affected Products | Chrome, ChromeOS, Android, Flutter | | CISA KEV Deadline | 2026-03-27 | | Patch Source | Google Security Advisories |

Monitor the Google Chrome Releases blog and Android Security Bulletins for confirmed fixed version numbers as Google publishes them.