CVE-2026-91708: Google Chrome Race Condition Vulnerability

CVE-2026-91708 Overview

CVE-2026-91708 is a race condition vulnerability in the Network component of Google Chrome versions prior to 153.0.8010.47. The flaw allows a remote attacker who has already compromised the renderer process to obtain cross-origin data through a crafted HTML page. Chromium classifies the security severity as High, while the NVD assigns a lower CVSS score reflecting the required preconditions and user interaction. The vulnerability is tracked as CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition.

Critical Impact
An attacker who controls a compromised renderer process can leak cross-origin data, breaking the Same-Origin Policy that isolates web content in Chrome.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.47
Chromium-based browsers that inherit the vulnerable Network stack
Downstream distributions bundling the pre-patch Chromium release

Discovery Timeline

2026-09-15 - CVE-2026-91708 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database
2026-09-15 - Google publishes Stable Channel Update disclosing the fix in the Chrome Releases blog

Technical Details for CVE-2026-91708

Vulnerability Analysis

The issue is a race condition in Chrome's Network component. Race conditions occur when two or more code paths access shared state without correct synchronization, allowing an attacker to influence execution ordering. In this case, the flaw enables cross-origin data disclosure, meaning content that should be isolated by the browser's Same-Origin Policy can be observed by attacker-controlled code.

Exploitation requires the attacker to have already compromised the Chrome renderer process. The renderer is sandboxed, so on its own it cannot read arbitrary cross-origin resources. This vulnerability provides a mechanism to bypass that boundary through timing-sensitive interactions with the network service.

User interaction is required, and attack complexity is high because the attacker must reliably win the race. The impact is limited to confidentiality; integrity and availability are not affected. Additional detail is available in the Chromium Issue Tracker entry.

Root Cause

The underlying defect is a CWE-367 time-of-check to time-of-use flaw in the Network component. Security-relevant state is validated at one point, then used at a later point without guaranteeing the state has not changed. A compromised renderer can influence timing to make a cross-origin response reachable through an attacker-controlled code path.

Attack Vector

The attacker first compromises the renderer process, typically by chaining a separate renderer bug. From the compromised renderer, the attacker serves a crafted HTML page that triggers the race in the Network component. Winning the race causes cross-origin bytes to be returned into a context the attacker can observe. Because the attack is remote over the network and requires only that a user load attacker-controlled content, standard phishing and drive-by-download delivery methods apply.

No verified public exploit code is available for CVE-2026-91708 at the time of publication. Refer to the Chromium Issue Tracker entry once access restrictions are lifted for implementation-level detail.

Detection Methods for CVE-2026-91708

Indicators of Compromise

Chrome browser processes reporting version strings below 153.0.8010.47 across managed endpoints
Renderer process crashes or unexpected child process spawns preceding suspicious outbound HTTPS activity
Web traffic to newly registered or low-reputation domains serving heavily obfuscated JavaScript designed to trigger race conditions

Detection Strategies

Inventory installed browser versions using endpoint telemetry and flag hosts running Chrome builds earlier than 153.0.8010.47
Correlate renderer process anomalies with cross-origin fetch patterns that deviate from a user's normal browsing behavior
Monitor for exploit chains, since this bug is only usable after a separate renderer compromise; alert on prior-stage indicators such as sandbox escapes or memory corruption crashes

Monitoring Recommendations

Enable Chrome Enterprise reporting and forward browser version and crash telemetry to a central analytics platform
Track DNS and HTTP telemetry for repeated cross-origin requests originating from a single tab in short time windows, a common race-exploitation pattern
Review threat intelligence feeds and the Chrome Releases blog for updated indicators tied to Chromium 153 vulnerabilities

How to Mitigate CVE-2026-91708

Immediate Actions Required

Update all Chrome installations to version 153.0.8010.47 or later on Windows, macOS, and Linux
Restart browsers after applying the update to ensure the patched Network component is loaded
Push the update to managed fleets through Chrome Browser Cloud Management, Group Policy, or your endpoint management platform

Patch Information

Google addressed CVE-2026-91708 in Chrome Stable 153.0.8010.47. Details are published in the Stable Channel Update for Desktop. Chromium-based browsers such as Microsoft Edge, Brave, and Opera should be updated once vendors integrate the upstream fix.

Workarounds

No official workaround eliminates the vulnerability; patching is the only complete remediation
Reduce exposure by restricting browsing on privileged workstations and enforcing site isolation, which remains enabled by default in Chrome
Apply strict Content Security Policy and Cross-Origin-Resource-Policy headers on internally hosted applications to limit the value of any leaked cross-origin data

bash

# Verify installed Chrome version on Linux and macOS endpoints
google-chrome --version
# Expected output on patched hosts: Google Chrome 153.0.8010.47 or later

# Windows managed deployment: force update check via registry policy
# HKLM\SOFTWARE\Policies\Google\Update\AutoUpdateCheckPeriodMinutes = 60