CVE-2026-3909: Google Skia Out-of-Bounds Write Vulnerability

Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out-of-bounds memory access. The flaw is reached when affected software processes a crafted HTML page. This issue affects Google Chrome, ChromeOS, Android, Flutter, and possibly other products that rely on Skia for graphics operations. Organizations that deploy these components should determine exposure promptly because memory corruption flaws of this class can lead to further compromise once triggered.

How it works

The weakness is recorded as CWE-787, an out-of-bounds write. Skia fails to keep write operations within the intended memory region when handling certain malformed input.

• An attacker supplies a crafted HTML page that is rendered by the affected component.
• The malformed content causes the library to write data past the end of an allocated buffer.
• Successful abuse grants the attacker out-of-bounds memory access; exact mechanics and prerequisites must be confirmed against the vendor advisory.

Am I affected? How to find it in your systems

Skia is embedded in Google Chrome, ChromeOS, Android, and Flutter-based applications. Inventory all endpoints, browsers, mobile devices, and custom applications that include these components.

• Check installed versions of Chrome, ChromeOS, Android, and any Flutter runtimes against the vendor advisory for affected releases.
• Review enterprise deployment tools and mobile device management consoles to locate instances that cannot be updated automatically.
• Monitor web proxy or browser telemetry for repeated rendering of external or untrusted HTML content that may serve as attack delivery.

How to remediate

Apply the vendor update referenced in the official advisory as the primary action. After patching, verify that the updated Skia library is active in Chrome, ChromeOS, Android, and Flutter deployments.

• Follow any configuration or hardening steps supplied by the vendor for this class of graphics-processing vulnerability.
• Apply applicable CISA BOD 22-01 guidance for cloud-hosted instances of the affected products.

If you can't patch immediately

Apply mitigations exactly as described in the vendor instructions. Where mitigations are unavailable, discontinue use of the affected product until an update can be installed.

• Restrict rendering of untrusted HTML content through network segmentation or application allow-listing.
• Enable logging of browser and graphics-related crashes for later review.
• Monitor for vendor or CISA updates that may provide additional temporary controls.

If your data may have been exposed

Actively exploited memory-safety vulnerabilities have preceded data breaches in other incidents. Organizations can run a free exposure scan of their email addresses to check against known breach data sets while completing the inventory and patching steps above.