Skip to main content
Mallory
HighCISA KEVExploited in the wildPublic exploit

Out-of-bounds write in Skia in Google Chrome

IdentifiersCVE-2026-3909CWE-787· Out-of-bounds Write

CVE-2026-3909 is a high-severity out-of-bounds write vulnerability in Skia, the open-source 2D graphics library used by Google Chrome to render web content and user interface elements. According to the provided content, affected Chrome versions are prior to 146.0.7680.75, and the issue can be triggered by a remote attacker via a crafted HTML page, resulting in out-of-bounds memory access. Public reporting states Google confirmed exploitation in the wild and patched the issue in Chrome 146.0.7680.75/.76.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can cause memory corruption through an out-of-bounds write in Skia. The provided reporting states this may crash the browser and could potentially lead to code execution. Because the bug was exploited as a Chrome zero-day in the wild, the practical impact includes remote compromise of the browser context when a target visits attacker-controlled or attacker-supplied web content.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure to untrusted web content and restrict use of vulnerable Chrome and Chromium-based browsers until updates are applied. Prioritize rapid deployment because Google reported in-the-wild exploitation and withheld technical details while patches propagated. Also verify patch status for products that depend on the affected shared component/library through their own release cycles.

Remediation

Patch, then assume compromise.

Update Google Chrome to a fixed version immediately. The provided content states fixes were released in Chrome 146.0.7680.75/76 for Windows and macOS and 146.0.7680.75 for Linux. Apply corresponding updates for other Chromium-based browsers as vendors make them available. Restart the browser after updating to ensure the patched build is active.
PUBLIC EXPLOITS

Exploits

2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 2 / 2 TOTALView more in app
CVE-2026-3909-PoCMaturityPoCVerified exploit

This repository is a small, focused proof-of-concept for CVE-2026-3909 against Chromium/Chrome’s Skia-backed GPU text/raster pipeline. It is not a standalone exploit program or framework module; instead, it provides two patch files meant to be applied to a vulnerable Chromium source tree plus a minimal local HTML trigger page. Repository structure: - README.md: explains the vulnerability context, target Chromium revision, build arguments, patch locations, usage, and expected crash output. - raster_implementation.cc.patch: modifies Chromium GPU client code in RasterImplementation::UnmapRasterCHROMIUM. - SkChromeRemoteGlyphCache.cpp.patch: modifies Skia glyph cache handling in SkStrikeServer::writeStrikeData. - trigger.html: minimal page used to exercise the patched rendering path. Main exploit capability: - The PoC injects hardcoded malformed serialized rendering/glyph data into internal renderer-side buffers. - In SkChromeRemoteGlyphCache.cpp.patch, when running in a renderer process and the strike-data buffer is empty, the patch replaces it with a large attacker-controlled byte array. - In raster_implementation.cc.patch, when running in a renderer process, the patch overwrites the mapped raster buffer with crafted DrawSlugOp serialized data and tweaks format fields to create inconsistent state. - The intended effect is to drive Chromium/Skia into an invalid atlas plot lookup, producing an out-of-bounds access and abort in GrDrawOpAtlas::hasID(), evidenced by the README’s stack trace. Attack surface and delivery: - Primary vector is browser/file-based local content: the user opens trigger.html in the patched vulnerable browser. - There are no C2 endpoints, remote callback URLs, or exfiltration routines. - No shellcode, reverse shell, persistence, or post-exploitation logic is present. Assessment: - This is a real exploit PoC, but only for crash reproduction/bug triggering. - It is best classified as POC maturity because the payload is hardcoded and aimed at demonstrating the vulnerability rather than achieving arbitrary code execution.

anansi2safeDisclosed Apr 10, 2026markdownc++browserlocalfile
CVE-2026-3909MaturityPoCVerified exploit

This repository is a small Chromium browser proof-of-concept for CVE-2026-3909, not a standalone exploit framework. It contains four files: a README, two patch files against Chromium/Skia source, and a minimal trigger.html page. The exploit is designed to be applied to a vulnerable Chromium source tree and built locally, then triggered by opening the local HTML file. The core capability is crash triggering via malformed internal graphics/text serialization, not remote code execution. The raster_implementation.cc patch hooks RasterImplementation::UnmapRasterCHROMIUM and, when running in a renderer process, overwrites the mapped raster buffer with a hardcoded serialized DrawSlugOp blob. It also mutates selected fields to alter mask/pixel formats before copying the payload into the raster buffer. The SkChromeRemoteGlyphCache.cpp patch hooks SkStrikeServer::writeStrikeData and, if the process is a renderer and the original strike-data buffer is empty, replaces it with a large hardcoded byte array representing crafted strike/glyph data. Together these patches force Chromium/Skia to process inconsistent atlas/glyph state. The README documents the intended target version context (Chromium 146.0.7680.71), Linux x64 debug build arguments, usage steps, and the resulting abort stack trace. It also suggests optional debug instrumentation in DrawAtlas::hasID() to observe invalid plot indices and notes that on stable builds similar logic could be implemented via runtime hooks instead of source patches. There are no external C2, download, or network callback endpoints in the exploit logic. The only meaningful observables are local file paths, Chromium source paths, and the process-type switch value used to ensure execution in the renderer process. Overall, this is a browser/file-triggered PoC that demonstrates reliable denial-of-service/crash behavior in vulnerable Chromium/Skia rendering paths.

anansi2safeDisclosed Apr 10, 2026markdowndiffbrowserfilelocal
EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
GoogleChromeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures2

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity87

Community discussion across Reddit, Mastodon, and other social sources.