CVE-2026-91711 Overview
CVE-2026-91711 is an out-of-bounds write vulnerability in the ServiceWorker component of Google Chrome. Versions prior to 153.0.8010.47 are affected. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to load a crafted HTML page. The flaw is tracked under CWE-787: Out-of-bounds Write and rated High severity by the Chromium project.
Critical Impact
Successful exploitation grants arbitrary code execution inside the Chrome renderer sandbox, providing an initial foothold that can be chained with a sandbox escape to compromise the host.
Affected Products
- Google Chrome Desktop (Windows, macOS, Linux) prior to 153.0.8010.47
- Chromium-based browsers integrating the vulnerable ServiceWorker code
- Embedded Chromium runtimes (CEF, Electron) that ship the affected version
Discovery Timeline
- 2026-09-15 - CVE-2026-91711 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91711
Vulnerability Analysis
The vulnerability resides in Chrome's ServiceWorker implementation. ServiceWorkers are scriptable network proxies that run in the background of the browser and intercept fetch, message, and push events. An out-of-bounds write occurs when the ServiceWorker component writes data past the boundaries of an allocated buffer. This corruption allows an attacker to overwrite adjacent memory structures within the renderer process. The Chromium project classifies the defect as High severity because reliable exploitation leads to arbitrary code execution inside the renderer sandbox.
Root Cause
The root cause is a memory safety defect in the ServiceWorker code path where input size or index validation fails before a write operation. Because ServiceWorker logic handles attacker-controlled event data and cached resources, malformed inputs can drive the write beyond the intended allocation. This class of bug maps directly to CWE-787 and typically involves incorrect bounds checks, unchecked arithmetic on buffer indices, or missing validation of serialized message payloads.
Attack Vector
Exploitation requires user interaction. A victim must visit or be redirected to a page under attacker control. The malicious HTML page registers or interacts with a ServiceWorker that triggers the vulnerable code path. No authentication is required, and the attack completes over the network. Code execution is confined to the renderer sandbox unless combined with a separate sandbox escape. See the Chromium Issue Tracker #558342353 and the Google Chrome Stable Update advisory for vendor details.
No public proof-of-concept exploit code is available at the time of publication. Technical specifics of the write primitive have not been disclosed by Google, following standard Chromium embargo practice.
Detection Methods for CVE-2026-91711
Indicators of Compromise
- Chrome renderer processes crashing with access violations or heap corruption signatures when browsing untrusted content
- Unexpected ServiceWorker registrations under %LocalAppData%\Google\Chrome\User Data\Default\Service Worker\ on Windows or the equivalent profile paths on macOS and Linux
- Outbound connections from chrome.exe renderer children to newly registered or low-reputation domains immediately after page loads
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any host running a build earlier than 153.0.8010.47
- Correlate browser crash telemetry (chrome_crashpad) with visits to unclassified domains to surface potential exploitation attempts
- Monitor for post-exploitation behavior originating from Chrome child processes, including unexpected process spawns, DLL loads, or LOLBin execution
Monitoring Recommendations
- Ingest EDR process telemetry for chrome.exe and its renderer children into a central data lake and alert on anomalous child process creation
- Enable browser management policies that report installed versions and extension inventories to a central console
- Track ServiceWorker registrations on managed endpoints using enterprise browser reporting to identify persistence attempts
How to Mitigate CVE-2026-91711
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.47 or later on all Windows, macOS, and Linux endpoints
- Restart Chrome after installation so the patched binaries are loaded into every running process
- Audit Chromium-based applications and embedded runtimes for the vulnerable version and schedule vendor updates
Patch Information
Google released the fix in the Stable channel update documented in the Google Chrome Stable Update advisory. Administrators should deploy Chrome 153.0.8010.47 or later. Enterprise environments can push the update through Chrome Browser Cloud Management, Google Update policies, or standard software distribution tools such as SCCM, Intune, or Jamf.
Workarounds
- Enforce automatic Chrome updates through the UpdateDefault and AutoUpdateCheckPeriodMinutes enterprise policies until all endpoints reach the fixed build
- Restrict browsing to trusted domains using URL allowlists via the URLAllowlist and URLBlocklist policies for high-risk user groups
- Disable third-party ServiceWorker registration on managed profiles where business workflows permit, reducing exposure to malicious registrations
# Configuration example: enforce minimum Chrome version via Group Policy on Windows
# Registry path: HKLM\SOFTWARE\Policies\Google\Chrome
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v "TargetVersionPrefix" /t REG_SZ /d "153.0.8010.47" /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v "UpdateDefault" /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v "AutoUpdateCheckPeriodMinutes" /t REG_DWORD /d 60 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.