Skip to main content
Skip table of contents

ISN 2026-06: Chromium Vulnerabilities Exploited in the Wild

First published 19 March 2026

CVSS:3.1: 9.8 (Critical)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

A security vulnerability has been found in Chromium, a web browser used in IGEL OS. This affects the following product versions:

  • IGEL OS 12

  • IGEL OS 11

Details

A critical heap buffer overflow (CVE-2026-3913) has been found in Chromium’s implementation of the Web Modeling Language (WebML). It can be exploited via a crafted HTML page. The WebML component also suffers from an integer overflow (CVE-2026-3914, high), a further heap buffer overflow (CVE-2026-3915, high), and an out-of-bounds memory access (CVE-2026-3920, high).

The 2D graphics library Skia is affected by an out-of-bounds write (CVE-2026-3909, high). Google reports that this vulnerability is being exploited in the wild.

Other issues rated high include an out-of-bounds read in Web Speech (CVE-2026-3916), a use-after-free in Agents (CVE-2026-3917), and another use-after-free in WebMCP (High CVE-2026-3918). A full list of vulnerabilities is available in the referenced blog posts from the Chrome Releases team.

Update Instructions

  • OS 12: Update to the Chromium app in version 146.0.7680.80 or newer when available from the IGEL App Portal.

  • OS 11: Update to IGEL OS 11.11.130 or newer when available.

References

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close