CVE-2026-91714: Google Chrome Information Disclosure Flaw

CVE-2026-91714 Overview

CVE-2026-91714 is an observable discrepancy vulnerability in the Fonts component of Google Chrome versions prior to 153.0.8010.47. A remote attacker can exploit this side-channel weakness through a crafted HTML page to leak sensitive information from the browser. Exploitation requires user interaction and social engineering to lure the target to attacker-controlled content. The Chromium project rates the security severity as Medium. The flaw is tracked under CWE-203: Observable Discrepancy and affects desktop Chrome installations across supported operating systems.

Critical Impact
Successful exploitation allows a remote attacker to leak sensitive information from the browser context by observing timing or rendering differences in font handling.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.47
Chromium-based browsers incorporating the vulnerable Fonts component
Windows, macOS, and Linux Chrome Stable channel builds

Discovery Timeline

2026-09-15 - CVE-2026-91714 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91714

Vulnerability Analysis

The vulnerability resides in the Fonts subsystem of Google Chrome. An observable discrepancy exists in how the browser processes or renders fonts, which allows an attacker to infer information that should remain isolated across origins or sessions. By measuring differences in behavior between distinct inputs, an attacker can reconstruct sensitive data that the browser handles internally.

Attack complexity is high because the attacker must craft a page that triggers the discrepancy reliably and must convince a user to visit it. No authentication is required, and the flaw does not affect integrity or availability. Confidentiality is the sole security property at risk. The issue is classified under CWE-203, which covers information exposure through observable differences in program behavior.

Root Cause

The root cause is a side-channel weakness in the Fonts component. Distinct code paths, timing profiles, or rendering outcomes produce measurable differences that correlate with data an attacker should not be able to see. This class of flaw typically arises when security-sensitive operations do not execute in constant time or produce output that varies with the input in an observable way.

Attack Vector

An attacker hosts a crafted HTML page and uses social engineering to bring a Chrome user to that page. The page executes JavaScript and font-loading logic that probes the discrepancy. The attacker then reads back the observable signal, such as timing measurements or rendered pixel behavior, and infers the sensitive value. No verified public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Chromium Issue Tracker entry 517710554 and the Google Chrome Stable Update advisory for vendor detail.

Detection Methods for CVE-2026-91714

Indicators of Compromise

Chrome desktop clients running versions earlier than 153.0.8010.47 connecting to unfamiliar or newly registered domains hosting HTML content
Browser telemetry showing repeated font-loading requests or high-resolution timer usage from a single page
User reports of following links from unsolicited email, chat, or social media messages prior to unusual account activity

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag hosts below 153.0.8010.47 for patching priority
Correlate web proxy logs with threat intelligence to identify visits to attacker-controlled pages known to probe browser side channels
Hunt in endpoint telemetry for Chrome child processes rendering pages from low-reputation domains delivered through phishing vectors

Monitoring Recommendations

Track Chrome auto-update status through management tooling and alert on stalled or disabled update channels
Monitor for social engineering campaigns that direct users to browser-exploitation landing pages
Review browser extension inventories and restrict extensions that can inject or fingerprint fonts across origins

How to Mitigate CVE-2026-91714

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all Windows, macOS, and Linux endpoints
Verify that Chrome auto-update is enabled and functioning across the managed fleet
Restart Chrome after the update installs so the patched binaries load into active browser sessions

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. Administrators should validate the fixed build 153.0.8010.47 through chrome://settings/help or an enterprise management console. Chromium-based downstream browsers should apply the corresponding upstream fix once vendors publish releases.

Workarounds

Deliver user awareness guidance that discourages clicking links from unverified senders while patches are being deployed
Use enterprise browser policies to block navigation to newly registered or low-reputation domains through URL filtering
Where feasible, apply strict site isolation and disable non-essential experimental features that expand the browser attack surface

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Enterprise policy example (Windows registry) to enforce auto-update
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f