CVE-2026-91713 Overview
CVE-2026-91713 is a missing authorization vulnerability [CWE-862] in the Browser component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.47. A remote attacker who has already compromised the renderer process can spoof user interface elements through a crafted HTML page. Google classifies the Chromium security severity as Medium.
The vulnerability requires an existing compromise of the renderer process and user interaction, which limits standalone exploitation. However, it can be chained with a renderer exploit to increase the credibility of phishing or social engineering attacks delivered through the browser.
Critical Impact
Attackers can spoof trusted browser UI elements to deceive users after compromising the renderer, enabling convincing phishing and credential theft workflows.
Affected Products
- Google Chrome versions prior to 153.0.8010.47
- Chromium-based browsers that inherit the vulnerable Browser component
- Desktop Chrome distributions on Windows, macOS, and Linux
Discovery Timeline
- 2026-09-15 - CVE-2026-91713 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91713
Vulnerability Analysis
The vulnerability resides in the Browser process, which is the trusted, higher-privileged component that manages UI rendering, navigation, and coordination between renderer processes. Missing authorization checks allow a compromised renderer to instruct the Browser process to display or manipulate UI elements it should not control.
Because the renderer normally handles untrusted web content in a sandbox, the Browser process is expected to validate any requests that influence trusted UI surfaces such as address bars, permission prompts, or dialog boxes. This validation is absent in the affected code path, permitting spoofing.
Exploitation requires two conditions. The attacker must already have code execution inside the renderer, typically via a separate vulnerability, and the victim must interact with a crafted HTML page. The combined complexity keeps the standalone impact bounded, but the UI spoofing capability meaningfully upgrades follow-on social engineering.
Root Cause
The root cause is a missing authorization check [CWE-862] in an inter-process communication (IPC) path between the renderer and the Browser process. The Browser process accepts a request that should have been gated by an origin or capability check, allowing the compromised renderer to influence trusted UI drawing.
Attack Vector
Exploitation is network-based through a crafted HTML page. The attacker first leverages a renderer compromise, then invokes the unauthorized IPC to render spoofed UI elements. The user is presented with a UI surface that appears to originate from the browser itself, enabling deception such as fake permission prompts, spoofed origins, or misleading security indicators.
No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Refer to the Chromium Issue Tracker Entry for technical details.
Detection Methods for CVE-2026-91713
Indicators of Compromise
- Chrome browser processes running versions earlier than 153.0.8010.47 in the environment
- Renderer process crashes or unusual IPC message volume preceding UI anomalies
- User reports of unexpected permission prompts, dialogs, or address bar inconsistencies
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag installations below 153.0.8010.47
- Monitor browser telemetry for renderer crashes correlated with visits to untrusted domains
- Correlate web proxy logs with endpoint telemetry to identify pages serving renderer exploit payloads
Monitoring Recommendations
- Enable browser enterprise reporting to capture version, extension, and crash telemetry centrally
- Ingest endpoint and browser logs into a centralized data lake for cross-correlation with phishing indicators
- Alert on Chrome installations that fall behind the current Stable channel release for more than one cycle
How to Mitigate CVE-2026-91713
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.47 or later on all managed endpoints
- Restart Chrome after updating to ensure the patched Browser process is active
- Verify Chromium-based third-party browsers have integrated the corresponding upstream fix
Patch Information
Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. Upgrading to Chrome 153.0.8010.47 or later remediates the missing authorization check. Enterprise deployments should validate the update through Chrome Browser Cloud Management or existing software distribution channels.
Workarounds
- Enforce automatic Chrome updates through group policy or mobile device management (MDM) profiles
- Restrict browsing to trusted sites via web filtering while patching is rolled out
- Train users to be skeptical of unexpected in-browser prompts requesting credentials or permissions
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Windows: query the installed version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version
# macOS: query the installed version via defaults
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
