CVE-2026-91712: Google Chrome Extensions Race Condition Flaw

CVE-2026-91712 Overview

CVE-2026-91712 is a race condition vulnerability in the Extensions component of Google Chrome on macOS. Versions prior to 153.0.8010.47 are affected. A remote attacker who has already compromised the renderer process can exploit this flaw through a crafted HTML page. Successful exploitation may lead to arbitrary code execution outside the Chrome sandbox. Google's Chromium team classified the underlying issue with a High security severity rating. The vulnerability is tracked under CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition.

Critical Impact
Attackers who chain this flaw with a prior renderer compromise can escape the Chrome sandbox on macOS and execute arbitrary code with the browser process's privileges.

Affected Products

Google Chrome for macOS prior to 153.0.8010.47
Apple macOS (all supported versions running vulnerable Chrome builds)
Chromium-based browsers on macOS that share the affected Extensions code path

Discovery Timeline

2026-09-15 - CVE-2026-91712 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91712

Vulnerability Analysis

The flaw is a race condition in the Chrome Extensions subsystem on macOS. Race conditions occur when concurrent operations access shared state without proper synchronization. In this case, the timing window enables an attacker-controlled renderer to influence extension-related state between validation and use. This is the classic TOCTOU pattern captured by CWE-367. Exploitation requires an already-compromised renderer process, raising attack complexity. When the race is won, the attacker can pivot from the low-privilege sandboxed renderer into higher-privileged browser context. This constitutes a sandbox escape, which is the core defense boundary Chrome relies on to contain hostile web content.

Root Cause

The root cause is inadequate synchronization in the Extensions component when handling operations that traverse the renderer-to-browser trust boundary. A crafted sequence of extension-related IPC messages, issued from a compromised renderer, allows the attacker to manipulate state after a security check but before the state is consumed. See Chromium Issue #521486621 for the tracked defect.

Attack Vector

Exploitation proceeds in two stages. First, the attacker compromises the renderer process using a separate vulnerability or a malicious page combined with a renderer bug. Second, the attacker delivers a crafted HTML page that triggers the racing extension operations. User interaction is required, typically visiting the attacker-controlled page. On success, code executes outside the sandbox with the privileges of the Chrome browser process on macOS. No proof-of-concept exploit or CISA KEV listing exists for this CVE at publication time.

No verified exploit code is publicly available for CVE-2026-91712.
Refer to Chromium Issue #521486621 for restricted technical details.

Detection Methods for CVE-2026-91712

Indicators of Compromise

Chrome renderer or helper processes on macOS spawning unexpected child processes such as /bin/sh, osascript, or curl.
Unexpected file writes by Google Chrome Helper processes to paths outside the Chrome profile directory.
Outbound network connections from Chrome helper processes to previously unseen domains shortly after a browsing session.
Chrome browser process versions reported below 153.0.8010.47 on managed macOS endpoints.

Detection Strategies

Inventory installed Chrome versions across macOS fleets and flag any build lower than 153.0.8010.47.
Alert on parent-child process anomalies where Chrome helper processes spawn shells or scripting interpreters.
Correlate browser crashes in the Extensions subsystem with subsequent unusual process or network activity on the same host.

Monitoring Recommendations

Ingest macOS Endpoint Security Framework telemetry covering process creation, file writes, and network connections attributed to Chrome.
Monitor Chrome's update channel and enforce automatic updates through MDM policy.
Track extension install and update events from managed browser policies to identify unexpected changes.

How to Mitigate CVE-2026-91712

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 153.0.8010.47 or later.
Restart Chrome after the update to ensure the patched binary is loaded across all processes.
Audit installed browser extensions and remove any that are unused, unverified, or from untrusted publishers.
Prioritize patching for high-value users such as developers, administrators, and executives whose renderers face targeted content.

Patch Information

Google released the fix in the Chrome Stable channel for desktop. Refer to the Google Chrome Stable Update advisory for release notes. The vulnerability is resolved in Chrome 153.0.8010.47 for macOS. Enterprises using Chrome Browser Cloud Management or MDM should push the updated version through existing channels.

Workarounds

No vendor-supplied workaround exists; upgrading to the patched build is the only supported remediation.
Restrict extension installation via enterprise policy using ExtensionInstallAllowlist and ExtensionInstallBlocklist to reduce the attack surface until patching completes.
Use macOS application allowlisting to constrain what Chrome helper processes may execute post-exploitation.

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force an update check via the Chrome update helper
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot

# Example MDM-deployed Chrome policy to restrict extensions (JSON snippet)
# /Library/Managed Preferences/com.google.Chrome.plist equivalent
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": ["<approved-extension-id-1>", "<approved-extension-id-2>"]
}