Active Exploits of Google Skia Out‑of‑Bounds Write (CVE‑2026‑3909) and Chromium V8 Unspecified Vulnerability (CVE‑2026‑3910) Added to CISA KEV Catalog
What It Is – CISA has placed two Google‑origin vulnerabilities—an out‑of‑bounds write in the Skia graphics library (CVE‑2026‑3909) and an unspecified flaw in the Chromium V8 JavaScript engine (CVE‑2026‑3910)—into its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild.
Exploitability – Both CVEs are confirmed to be actively exploited by threat actors; proof‑of‑concept exploits have been observed in the wild. While official CVSS scores are pending, the KEV inclusion signals a high‑severity risk.
Affected Products – Google Skia (used in Android, Chrome, Flutter, and many third‑party apps) and Google Chromium V8 (embedded in Chrome, Edge, and countless SaaS platforms).
TPRM Impact – Any third‑party that incorporates Skia or V8—directly or via downstream software—faces a supply‑chain exposure that could lead to remote code execution, data leakage, or service disruption.
Recommended Actions –
- Inventory all vendors and internal applications that embed Google Skia or Chromium V8.
- Verify that the latest patched versions (as released by Google) are deployed; prioritize remediation per CISA BOD 22‑01 deadlines.
- Apply compensating controls (e.g., application sandboxing, network segmentation) where immediate patching is not possible.
- Incorporate these CVEs into your vulnerability‑management scoring and risk‑acceptance processes.
Source: CISA Advisory – Two Known Exploited Vulnerabilities Added to KEV Catalog