CVE-2026-3909

What it actually does

CVE-2026-3909 is a high-severity out-of-bounds write vulnerability in Skia, the graphics rendering engine used by Google Chrome. A remote attacker can trigger memory corruption by convincing a user to open a crafted HTML page. Successful exploitation can allow out-of-bounds memory access and may lead to renderer-process code execution, browser crashes, data exposure from the browser process, or further compromise when chained with a sandbox escape or privilege-escalation vulnerability. The issue affects Google Chrome versions prior to 146.0.7680.75 across supported desktop platforms.

Why it matters to the business

Exploitation can turn normal web browsing into an initial compromise path. Because Chrome is widely deployed on Windows, macOS, and Linux endpoints, vulnerable systems may expose organizations to credential theft, session hijacking, malware delivery, and follow-on ransomware activity. The vulnerability is listed in CISA KEV with active exploitation in the wild and a remediation due date of 2026-03-27, so organizations should treat patching as urgent even though the EPSS score is relatively low.

How an attack unfolds

An attacker hosts or injects a specially crafted HTML page that exercises vulnerable Skia rendering behavior in Chrome. The attacker then lures a target to the page through phishing, malvertising, compromised websites, messaging links, or redirection from another compromised site. When the vulnerable browser renders the malicious content, the Skia out-of-bounds write corrupts memory. Depending on exploit reliability and mitigations, this may crash the renderer, disclose browser memory, or execute attacker-controlled code in the renderer context. To gain durable endpoint access, an attacker would commonly pair this with a browser sandbox escape, credential theft, malicious download execution, or another post-exploitation technique. Reported active exploitation context includes association with an Interlock ransomware campaign, so defenders should investigate browser exploitation as a potential precursor to hands-on-keyboard activity, payload staging, and ransomware deployment.

How to fix it

Upgrade Google Chrome to version 146.0.7680.75 or later on all platforms. Because browser updates often require a restart to complete, enforce browser relaunch after patch deployment and verify the running version, not only the installed package version. Use enterprise browser management, MDM, software distribution tools, or package managers to enforce automatic updates and prevent users from remaining on vulnerable builds. Where immediate patching is not possible, reduce exposure by restricting access to untrusted web content, using web isolation or remote browser isolation for high-risk users, blocking known malicious delivery infrastructure, disabling unmanaged browser installations, and increasing EDR monitoring for browser child-process abuse. CISA KEV status makes this a priority remediation item, with the KEV due date of 2026-03-27 as the latest acceptable deadline for covered organizations.

How to confirm the fix worked

Confirm that every managed Chrome installation reports version 146.0.7680.75 or later. Validate through multiple sources where possible: enterprise browser management console, endpoint inventory, package manager data, EDR software inventory, and local browser version checks such as chrome://version. Confirm that Chrome has been restarted after updating, since vulnerable processes may remain in memory until restart. Review unmanaged or user-installed Chrome copies in user profile paths, developer workstations, virtual desktops, golden images, kiosks, and servers used for automated browsing. For exposure validation, search for Chrome versions below 146.0.7680.75 and prioritize internet-heavy users, privileged users, and endpoints with recent browser crashes or suspicious post-browser activity.

Typical attack path

1. Attacker prepares a crafted HTML page that triggers the vulnerable Skia rendering path in Chrome prior to 146.0.7680.75.
2. Attacker delivers the page through phishing, malvertising, compromised legitimate sites, watering-hole content, or redirection infrastructure.
3. User opens the page in a vulnerable Chrome browser.
4. Chrome renders the malicious content and Skia performs an out-of-bounds write, causing memory corruption.
5. Exploit code attempts to gain execution or sensitive memory access inside the browser renderer process.
6. Attacker chains additional techniques such as sandbox escape, credential theft, malicious file download, or command-and-control beaconing.
7. If successful, attacker establishes persistence, moves laterally, steals data, or deploys additional malware including ransomware.

How to detect it

Detection should focus on evidence of exploitation attempts and post-exploitation behavior because browser memory-corruption exploits often leave few stable network or file indicators. Review EDR telemetry, browser crash reports, endpoint process creation logs, DNS/proxy logs, web gateway logs, download history, and security alerts around the time users visited suspicious or newly seen websites. Look for Chrome renderer crashes followed by unusual child processes, script execution, outbound connections, file downloads, credential-access tools, remote access tools, or ransomware staging. On Windows, review Crashpad reports, Windows Error Reporting, Security event logs, Sysmon process creation, PowerShell logs, and EDR memory-corruption alerts. On macOS, review Unified Logs, Chrome Crashpad reports, quarantine events, Gatekeeper prompts, LaunchAgent creation, and suspicious osascript or shell activity. On Linux, review Chrome crash reports, system logs, shell history where available, browser download artifacts, and suspicious child processes from Chrome. Because the vulnerability has active exploitation context and reported association with an Interlock ransomware campaign, extend hunts beyond the browser event itself to look for subsequent persistence, discovery, credential theft, lateral movement, data staging, and encryption behavior. Useful high-signal detections include Chrome spawning command shells or scripting engines, Chrome writing executables to download or temporary directories followed by execution, repeated renderer crashes when visiting a specific site, and vulnerable Chrome versions observed after the KEV publication window.

• Google Chrome < 146.0.7680.75
• chrome.exe --type=renderer
• chrome.exe --type=gpu-process
• EXCEPTION_ACCESS_VIOLATION
• STATUS_ACCESS_VIOLATION
• SIGSEGV
• Segmentation fault
• Crashpad\reports
• Chrome\User Data\Crashpad\reports
• AppData\Local\Google\Chrome\User Data\Crashpad\reports
• ~/Library/Application Support/Google/Chrome/Crashpad/reports
• ~/.config/google-chrome/Crashpad/reports
• chrome.exe -> cmd.exe
• chrome.exe -> powershell.exe
• chrome.exe -> wscript.exe
• chrome.exe -> cscript.exe
• chrome.exe -> mshta.exe
• chrome.exe -> rundll32.exe
• chrome.exe -> regsvr32.exe
• Google Chrome Helper -> /bin/sh
• Google Chrome Helper -> osascript
• google-chrome -> /bin/sh
• google-chrome -> bash
• Interlock

What your security team should do

• Immediately inventory Chrome versions and prioritize upgrades to 146.0.7680.75 or later across Windows, macOS, and Linux endpoints.
• Treat systems running vulnerable Chrome versions as high priority because the vulnerability is in CISA KEV and has active exploitation in the wild.
• Force browser restart after patching and re-check running process versions to ensure the vulnerable build is no longer active.
• Hunt for recent Chrome renderer crashes, suspicious browser-spawned child processes, unexpected downloads, and command-and-control activity following visits to unfamiliar sites.
• Prioritize forensic review of endpoints with vulnerable Chrome plus signs of ransomware precursors, including remote access tool installation, credential dumping, lateral movement, or unusual file encryption activity.
• Apply web filtering, browser isolation, and phishing protections to reduce exposure to malicious HTML delivery while patching completes.
• Ensure EDR rules alert when Chrome spawns shells, scripting engines, archive tools, remote access tools, or LOLBin utilities.
• Review unmanaged Chrome installations and portable browser copies that may not be covered by standard update controls.
• Track CISA KEV remediation obligations and use the 2026-03-27 deadline as a compliance backstop, not as a reason to delay patching.