CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two Google vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-3909 (Skia Out-of-Bounds Write) and CVE-2026-3910 (Chromium V8 Unspecified). Federal agencies are required to remediate these vulnerabilities by specified deadlines under Binding Operational Directive 22-01, with CISA urging all organizations to prioritize remediation as part of vulnerability management.
Summary
CISA has added two Google vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-3909 (Skia Out-of-Bounds Write) and CVE-2026-3910 (Chromium V8 Unspecified). Federal agencies are required to remediate these vulnerabilities by specified deadlines under Binding Operational Directive 22-01, with CISA urging all organizations to prioritize remediation as part of vulnerability management.
Indicators of Compromise
- cve — CVE-2026-3909
- cve — CVE-2026-3910