CVE-2026-91709: Google Chrome ServiceWorker RCE Vulnerability

CVE-2026-91709 Overview

CVE-2026-91709 is a type confusion vulnerability in the ServiceWorker component of Google Chrome versions prior to 153.0.8010.47. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Google's Chromium project rates the underlying issue as High severity. The flaw is tracked under CWE-843: Access of Resource Using Incompatible Type.

Exploitation requires user interaction such as visiting a malicious website. Successful attacks yield code execution within the renderer sandbox, which attackers typically chain with a sandbox escape to achieve full system compromise.

Critical Impact
A single visit to a malicious HTML page can trigger arbitrary code execution inside the Chrome renderer, providing a foothold for browser-based attack chains.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.47
Chromium-based browsers embedding the vulnerable ServiceWorker implementation
Downstream distributions that repackage Chrome or Chromium builds

Discovery Timeline

2026-09-15 - CVE-2026-91709 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91709

Vulnerability Analysis

The vulnerability resides in Chrome's ServiceWorker implementation, which manages background scripts that intercept network requests and cache responses for web applications. A type confusion condition allows the engine to interpret a memory object as an incompatible type. When the code operates on that object using assumptions from the wrong type, it can read or write memory outside intended boundaries.

Type confusion in a script-facing browser component typically enables attackers to corrupt object metadata, forge pointers, or manipulate object layouts. Attackers can leverage these primitives to gain arbitrary read and write access inside the renderer process, then pivot to arbitrary code execution within the Chrome sandbox.

Root Cause

The root cause is improper type validation inside the ServiceWorker code path, classified under CWE-843. The component fails to verify that an object matches the expected type before dereferencing it, leading to unsafe memory operations. Chromium tracks the underlying defect in Chromium Issue #547815507.

Attack Vector

Exploitation is network-based and requires the victim to load attacker-controlled HTML in a vulnerable Chrome build. The malicious page registers or interacts with a crafted ServiceWorker script that triggers the type confusion. Because ServiceWorkers persist across sessions and intercept future requests for their registered scope, attackers can also achieve resilient control over the affected origin.

Code execution is initially confined to the renderer sandbox. Adversaries typically pair such flaws with a separate sandbox escape to reach the host operating system. Public exploit code is not currently available, and CISA has not added the issue to the Known Exploited Vulnerabilities catalog.

Technical details are described in Chromium Issue #547815507 and the Chrome Releases update announcement.

Detection Methods for CVE-2026-91709

Indicators of Compromise

Chrome processes spawning unexpected child processes shortly after visiting an untrusted site
Unusual ServiceWorker registrations in the browser profile pointing to unfamiliar domains
Renderer process crashes referencing content::ServiceWorker frames in crash dumps
Outbound connections from Chrome renderer processes to atypical infrastructure following a browsing session

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 153.0.8010.47
Correlate browser crash telemetry with subsequent process creation or network anomalies from the same host
Hunt for suspicious ServiceWorker script URLs in browser telemetry, particularly on hosts that visited newly registered domains

Monitoring Recommendations

Ingest endpoint process and network telemetry into a centralized data lake to enable retroactive hunting for browser-borne exploitation
Alert on Chrome renderer processes launching shells, script interpreters, or LOLBins such as powershell.exe or cmd.exe
Track browser version compliance continuously through configuration management and vulnerability scanning tools

How to Mitigate CVE-2026-91709

Immediate Actions Required

Update Chrome to version 153.0.8010.47 or later on all Windows, macOS, and Linux endpoints
Restart the browser after patch deployment to ensure the new binary is loaded
Audit third-party Chromium-based applications and apply vendor updates that incorporate the fix
Prioritize systems used for high-risk browsing, developer workstations, and privileged users

Patch Information

Google addressed the vulnerability in the Stable channel release documented in the Chrome Releases update announcement. Users should verify the installed version through chrome://settings/help, which also triggers an update check.

Workarounds

No supported workaround exists; upgrading to the patched Chrome build is the only complete remediation
Restrict browsing to trusted sites via enterprise web filtering until patches are deployed
Use group policy to disable unnecessary ServiceWorker usage on managed profiles where feasible
Enforce site isolation and strict Enhanced Safe Browsing to reduce exposure to malicious pages

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Example Windows registry policy to force auto-update (Chrome Enterprise)
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f