CVE-2026-91710: Google Chrome Use After Free Vulnerability

CVE-2026-91710 Overview

CVE-2026-91710 is a use-after-free vulnerability in the WebAppInstalls component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.47 and allows a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires the victim to visit a crafted HTML page. Google classifies the Chromium security severity as High, and the CVSS scope change reflects the sandbox escape impact. The weakness maps to CWE-416: Use After Free.

Critical Impact
Successful exploitation grants arbitrary code execution outside the Chrome sandbox, giving attackers direct access to the underlying operating system through a single crafted web page.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.47
Chromium-based browsers incorporating the vulnerable WebAppInstalls code path
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-09-15 - CVE-2026-91710 published to NVD
2026-09-17 - Last updated in NVD database
2026-09 - Google releases Stable Channel update addressing the issue via Chrome Releases Blog

Technical Details for CVE-2026-91710

Vulnerability Analysis

The vulnerability resides in the WebAppInstalls subsystem, which handles the installation lifecycle of Progressive Web Apps (PWAs) and installable web content. A use-after-free condition occurs when the component references memory that has already been released. An attacker who controls the timing of object destruction can reclaim the freed allocation with attacker-controlled data. Because the flaw enables execution outside the renderer sandbox, exploitation bypasses one of Chrome's primary containment boundaries. The Chromium project tracks the underlying defect in Chromium Issue #553132148.

Root Cause

The defect stems from improper object lifetime management in WebAppInstalls. Code paths retain raw pointers or references to install-flow objects that can be destroyed asynchronously during user interaction or navigation events. When the freed object is later dereferenced, the process operates on stale memory, enabling a classic [CWE-416] condition.

Attack Vector

Exploitation is remote and requires user interaction, typically visiting an attacker-controlled page. The crafted HTML triggers install-related APIs in a sequence that frees an internal object while another code path still holds a reference. The attacker then sprays the heap to place controlled data at the freed address, achieving code execution outside the sandbox once the dangling pointer is used.

No public proof-of-concept code has been released for this issue. Technical detail beyond the vendor advisory remains restricted while users update.

Detection Methods for CVE-2026-91710

Indicators of Compromise

Chrome renderer or browser process crashes with heap corruption signatures shortly after visits to unfamiliar sites that prompt PWA installation
Unexpected child processes spawned by chrome.exe outside normal renderer sandbox parentage
Outbound network connections initiated by Chrome to attacker infrastructure immediately following an install prompt interaction

Detection Strategies

Inventory Chrome versions across endpoints and flag any build below 153.0.8010.47
Alert on browser process anomalies such as unsigned module loads, unexpected memory allocations with executable permissions, or code execution originating from browser worker threads
Correlate web proxy logs against threat intelligence for domains hosting suspicious PWA manifests or install prompts

Monitoring Recommendations

Enable endpoint telemetry on browser process trees to catch post-exploitation child processes
Log and review Chrome crash dumps for use-after-free patterns in WebAppInstalls symbols
Monitor for lateral movement or credential access activity originating from user workstations after browser exploitation windows

How to Mitigate CVE-2026-91710

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all managed endpoints
Restart the browser after update to ensure the patched binaries are loaded into memory
Push updates to Chromium-derived browsers as their upstream releases incorporate the fix
Communicate to users to avoid clicking install prompts from untrusted sites until patching is complete

Patch Information

Google addressed the vulnerability in the Stable Channel Desktop update announced on the Chrome Releases Blog. Administrators should confirm deployment via chrome://settings/help or enterprise management consoles. Managed environments using Chrome Browser Cloud Management or Group Policy should verify update rollout status.

Workarounds

Disable Progressive Web App installations via the WebAppInstallForceList and DefaultWebAppInstallEnabled enterprise policies until patching completes
Restrict browsing to trusted domains through web filtering while updates propagate
Enforce site isolation and disallow third-party PWA sources in Chrome enterprise policy

bash

# Verify Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify on Linux
google-chrome --version

# Ensure the reported version is 153.0.8010.47 or higher