Loading story…
Google Chrome received a security update for CVE-2026-3909, an out-of-bounds write flaw in the Skia graphics component, and CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. The issue affects Chrome desktop versions prior to 146.0.7680.80 on Windows, macOS, and Linux, and CISA’s KEV entry states the bug could allow a remote attacker to trigger out-of-bounds memory access through a crafted HTML page. The KEV record also notes that the vulnerable component is widely used and may affect ChromeOS, Android, Flutter, and other products depending on vendor implementation and patch status.
The available reporting indicates active exploitation awareness at the time of disclosure, elevating the issue from a routine browser patch to a priority remediation item. Canadian Centre for Cyber Security guidance directs administrators to review Google’s advisory and apply updates, while the KEV entry instructs organizations to follow vendor mitigations, comply with applicable BOD 22-01 requirements for cloud services, or discontinue use if no mitigation is available. Other advisories in the set cover unrelated vendor and ICS vulnerability bulletins and do not describe the same specific event.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-16, the Canadian Centre for Cyber Security published advisory AV26-240 highlighting Google's Chrome update and CISA's KEV listing for CVE-2026-3909. It urged users and administrators to review the vendor guidance and apply updates or mitigations as available.
Also on 2026-03-13, CISA added CVE-2026-3909 to its Known Exploited Vulnerabilities catalog, indicating the flaw had been exploited in the wild. The KEV entry noted the vulnerability's broader downstream impact on products that rely on the Skia component, including Chrome, ChromeOS, Android, and Flutter.
On 2026-03-13, Google published a security advisory addressing CVE-2026-3909, an out-of-bounds write vulnerability in Skia affecting Chrome Stable for Desktop. The advisory covered Chrome versions prior to 146.0.7680.80 on Windows and Mac, and Linux version 146.0.7680.80.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CISA** added two **Google Chrome** vulnerabilities to its **Known Exploited Vulnerabilities (KEV)** catalog after Google disclosed active exploitation in the wild. The flaws are **CVE-2026-3909**, an out-of-bounds write in **Skia**, and **CVE-2026-3910**, a **Chromium V8** memory-safety issue that can allow arbitrary code execution inside the browser sandbox via a crafted HTML page. Google rated both issues as high severity with **CVSS 8.8** and released fixes in Chrome **146.0.7680.75/76** for Windows and Mac and **146.0.7680.75** for Linux. CISA's KEV entry states that **CVE-2026-3910** may affect multiple Chromium-based browsers, including **Google Chrome, Microsoft Edge, and Opera**, while **CVE-2026-3909** impacts the shared **Skia** component and may affect **Chrome, ChromeOS, Android, Flutter, and other products** depending on vendor implementation. Federal agencies were directed to apply vendor mitigations or discontinue use if fixes are unavailable, with a remediation due date of **2026-03-27**. Neither source attributes the exploitation to a specific threat actor, but both confirm the vulnerabilities are being exploited and require prompt patching.
Jun 29, 2026
CISA has added the Google Chromium vulnerability CVE-2025-14174 to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. This high-severity flaw, found in the ANGLE graphics abstraction layer used by Chromium-based browsers, allows out-of-bounds memory access due to improper buffer sizing in the Metal renderer. The vulnerability affects Google Chrome on macOS prior to version 143.0.7499.110, with related fixes also applied to Windows and Linux builds. Exploitation of this vulnerability can lead to memory corruption, browser crashes, or potentially arbitrary code execution within the browser context. Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch agencies are required to remediate this vulnerability by the specified deadline, while CISA strongly encourages all organizations to prioritize patching. The addition of CVE-2025-14174 to the KEV catalog highlights its active exploitation and the significant risk it poses to federal and other enterprise environments. Organizations are urged to update affected systems promptly to mitigate the threat posed by this vulnerability.
Jun 29, 2026
Google released an urgent *Chrome for Desktop* Stable Channel update to address **CVE-2026-2441**, a high-severity zero-day that Google said has an exploit **active in the wild**. The issue is a **use-after-free in Chrome’s CSS component**, a memory-corruption flaw that can enable code execution in the browser context when a user visits a malicious or compromised webpage; the vulnerability was reported to Google by researcher **Shaheen Fazim**. The Canadian Centre for Cyber Security echoed the need to patch Chrome, advising organizations to update beyond affected Stable Channel versions (Windows/Mac prior to `145.0.7632.68` and Linux prior to `144.0.7559.67`), while third-party reporting indicated patched Stable builds rolling out to `145.0.7632.75/.76` (Windows/Mac) and `144.0.7559.75` (Linux). Other Canadian Centre advisories published in the same period covered unrelated vendor patches for **Tenable Nessus Agent** (CVE-2026-2026), **Juniper Secure Analytics (JSA)**, **HPE SimpliVity** (Intel firmware advisories), and **PostgreSQL** point releases; these are separate remediation items and not part of the Chrome zero-day event.
Jun 29, 2026