Executive summary

The US Cybersecurity and Infrastructure Security Agency (CISA) added two Google vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue on 13 March 2026, based on evidence of active exploitation: CVE-2026-3909, an out-of-bounds write in the Skia library, and CVE-2026-3910, a flaw in Chromium's V8 component. Google says it is aware that an exploit for each exists in the wild, and it shipped the fixes in two separate desktop updates: the V8 fix in builds announced on 12 March, and the Skia fix in Chrome 146.0.7680.80, posted on 13 March (01:15 UTC on 14 March). CISA's catalogue says the Skia flaw also affects ChromeOS, Android and Flutter, and that the V8 flaw could affect other Chromium-based browsers, including Microsoft Edge and Opera. We assess that CVE-2026-3909 is likely (B2) to stay open on more endpoints than CVE-2026-3910 over the coming week: its fix came a day later, in a build that Google says will roll out over the coming days or weeks, every desktop build below the V8 fix is also below the Skia fix, and Microsoft's 13 March Edge build is based on Chromium 146.0.7680.76. Tools that follow the CVE record, which Google's Chrome CVE numbering authority (CNA) filed, or the National Vulnerability Database (NVD) analysis of it could also count hosts at 146.0.7680.75 or .76 as fixed, since both place the Skia fix at 146.0.7680.75 while Google's 13 March release note places it in 146.0.7680.80.

Contextual background

CISA's 13 March alert lists the entries as "Google Skia Out-of-Bounds Write Vulnerability" (CVE-2026-3909) and "Google Chromium V8 Unspecified Vulnerability" (CVE-2026-3910). In the catalogue file published the same day, the V8 entry carries a more specific name, "Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability", with Common Weakness Enumeration (CWE) entry CWE-119; the Skia entry carries CWE-787. Both entries were added on 13 March 2026, both have a due date of 27 March 2026, and both record known ransomware campaign use as "Unknown". Binding Operational Directive (BOD) 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate KEV entries by the due date, and CISA urges all organisations to prioritise timely remediation of catalogue entries.

Google's statements on exploitation come from its own release note for the Skia flaw and, for the V8 flaw, from two advisories that repeat it. For the Skia flaw, Google's 13 March Stable channel update states that "Google is aware that an exploit for CVE-2026-3909 exists in the wild", and credits Google's Threat Analysis Group with reporting it on 10 March 2026. For the V8 flaw, the Canadian Centre for Cyber Security's advisory AV26-235 reports that Google published a security advisory on 12 March 2026 for Chrome desktop versions before 146.0.7680.75/76 (Windows and Mac) and 146.0.7680.75 (Linux), and that Google is aware that an exploit for CVE-2026-3910 exists in the wild. Microsoft's Security Update Guide entry for CVE-2026-3910, dated 13 March 2026 (05:11 UTC on 14 March), repeats the same Google statement.

Google's 13 March release note says access to bug details and links may be kept restricted until a majority of users are updated with a fix.

Technical analysis

Skia (CVE-2026-3909). Google's release note describes an "out of bounds write in Skia". The CVE description, as NVD received it on 13 March, says a remote attacker could "perform out of bounds memory access via a crafted HTML page" and gives a Chromium security severity of High. NVD's initial analysis records CWE-787, the same weakness as CISA's entry. CISA's catalogue note calls Skia a common open-source component or third-party library and tells users to check with specific vendors for their patching status.

V8 (CVE-2026-3910). The CVE description NVD received on 13 March calls it an "inappropriate implementation in V8" that allowed a remote attacker "to execute arbitrary code inside a sandbox via a crafted HTML page", again with a Chromium severity of High. CISA's catalogue classes it as CWE-119, while NVD's own initial analysis records CWE-94. For defenders the practical reading of both descriptions is that a crafted page loaded by the user is the delivery vehicle.

NVD's initial analysis gives both CVEs the same Common Vulnerability Scoring System (CVSS) 3.1 vector, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: attack over the network, low complexity, no privileges, and user interaction required.

The version boundary. For CVE-2026-3909 the CVE description reads "prior to 146.0.7680.75", and NVD's initial configuration marks Chrome versions up to (excluding) 146.0.7680.75 as affected. That CVE record came from Google's Chrome CNA and cites Google's 12 March release notes, and CISA's KEV note on CVE-2026-3909 points to the same 12 March page. Google's 13 March update moved desktop Chrome on Windows, Mac and Linux to 146.0.7680.80 and lists CVE-2026-3909 as its one security fix. By Google's 13 March release note, then, a desktop Chrome at 146.0.7680.75 or .76 has the V8 fix but not the Skia fix, while a tool that matches on NVD's configuration as it stood on 14 March would count it as fixed for both.

The table maps the descriptions to MITRE ATT&CK. Neither row is an observed technique from a published intrusion.

Technique Basis for the mapping
T1203 Exploitation for Client Execution Consistent with the V8 description: ATT&CK names web browsers as a common target, and the CVE describes code execution via a crafted HTML page
T1189 Drive-by Compromise As a precaution: a crafted HTML page implies delivery through a site the user visits, but no source describes how the exploits were delivered

ATT&CK's entry for T1203 notes that browsers are reached through drive-by compromise and through spearphishing links to adversary-controlled sites, so both delivery routes belong in scope.

Impact assessment

CISA's catalogue says the Skia flaw affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products, and that the V8 flaw could affect multiple browsers built on Chromium, including Google Chrome, Microsoft Edge and Opera. The exposure therefore runs well beyond the Chrome desktop estate: managed and unmanaged browsers, ChromeOS devices, Android devices and applications built on Flutter all fall inside the stated scope. For US federal civilian agencies the BOD 22-01 deadline is 27 March 2026.

On Android, Google released a Chrome 146 update on 13 March (01:19 UTC on 14 March) and states that Android releases contain the same security fixes as their corresponding desktop releases unless otherwise noted, linking that statement to the 13 March desktop update.

Detection and hunting guidance

With bug details restricted, hunting starts from exposure rather than indicators. The fixed builds stated in the sources are:

Product CVE-2026-3910 (V8) CVE-2026-3909 (Skia) Source
Chrome desktop, Windows and Mac 146.0.7680.75/76 146.0.7680.80 AV26-235; Google, 13 March
Chrome desktop, Linux 146.0.7680.75 146.0.7680.80 AV26-235; Google, 13 March
Microsoft Edge Stable 146.0.3856.59, based on Chromium 146.0.7680.76 Not covered by Microsoft's 13 March entry Microsoft
Opera and other Chromium-based browsers Check the vendor Check the vendor CISA

Google's same-day Android note gives the corresponding desktop builds as 146.0.7680.79/.80 (Windows and Mac) and 146.0.7680.79 (Linux), which does not match its desktop note; we use the desktop note's 146.0.7680.80.

Microsoft's entry dates Edge 146.0.3856.59 to 13 March 2026. Because that Edge build is based on Chromium 146.0.7680.76, a number below 146.0.7680.80, we do not treat it as covering the Skia flaw.

A version check across an asset inventory can be expressed generically. Adapt the table and column names to your own inventory, and compare version components as integers, not as text.

-- Hosts with a Chromium-based browser below the builds stated on 13 March 2026
-- (the Edge threshold covers CVE-2026-3910 only)
SELECT hostname, product, version
FROM software_inventory
WHERE (product = 'Google Chrome'  AND version_lt(version, '146.0.7680.80'))
   OR (product = 'Microsoft Edge' AND version_lt(version, '146.0.3856.59'));

Google says the 146.0.7680.80 update will roll out over the coming days or weeks, so an inventory taken now may show hosts mid-rollout. Check the version of the running browser after relaunch, not only the installed package. For a single Edge host, Microsoft's entry gives the check: the three-dot menu, then Help and Feedback, then About Microsoft Edge.

As a precaution, not an observed behaviour, review endpoint telemetry for browser processes that start unexpected child processes, particularly on hosts that ran a build below the fixed versions.

Incident response guidance

  1. Push Chrome 146.0.7680.80 or later to every desktop on Windows, Mac and Linux, and enforce a relaunch.
  2. Move Edge to 146.0.3856.59 or later now for CVE-2026-3910, and watch Microsoft's Security Update Guide for a build that covers CVE-2026-3909.
  3. Ask the vendor of every other Chromium-based browser, and of any product that embeds Chromium or Skia, for its patching status on both CVEs; CISA's note on the Skia entry gives this advice for CVE-2026-3909.
  4. Where a high-risk user ran an unpatched browser and reports odd browser behaviour, triage the endpoint as a possible compromise rather than waiting for indicators.

These are our recommendations, not vendor guidance.

Mitigation recommendations

  • Vulnerability management: treat KEV entries for browsers as emergency changes with a deadline measured in days, and score Chrome against Google's 13 March release note rather than the CVE record or NVD's configuration until they agree.
  • Software inventory: keep an inventory of every Chromium-based browser and embedded runtime, including those installed per user outside managed paths.
  • Application control: limit which browsers users may run, so that the update estate stays small enough to verify.

Historical context and related activity

The catalogue as published on 13 March 2026 shows the two new entries continuing a run of Google browser-component additions. Since September 2025 CISA has added CVE-2025-10585 (V8 type confusion, 23 September 2025), CVE-2025-13223 (V8 type confusion, 19 November 2025), CVE-2025-14174 (Chromium out-of-bounds memory access, 12 December 2025) and CVE-2026-2441 (Chromium CSS use-after-free, 17 February 2026). The CVE-2026-2441 entry carries the same warning that other Chromium-based browsers, including Edge and Opera, could be affected.

Future outlook

This section is assessment. We assess that further downstream fixes for CVE-2026-3909 are likely (B2) to appear over the coming days from Chromium-based browser vendors and from products that ship Skia, because CISA describes Skia as a common component used by different products and Microsoft's 13 March Edge release is based on a Chromium build below 146.0.7680.80. Until those vendors publish, defenders should treat any Chromium-based product below Chromium 146.0.7680.80 as exposed to the Skia flaw.

Further reading