CVE-2026-3909 is a high-severity out-of-bounds write vulnerability in the Skia graphics library component of Google Chrome. The vulnerability affects Chrome versions prior to 146.0.7680.75 and allows remote attackers to perform out-of-bounds memory access through specially crafted HTML pages. This vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. The flaw represents a significant security risk as it can be triggered remotely through malicious web content without user interaction beyond visiting a compromised webpage. Google has addressed this vulnerability in Chrome version 146.0.7680.75 and later releases.