CVE-2026-91715 Overview
CVE-2026-91715 is a type confusion vulnerability in the ServiceWorker component of Google Chrome prior to version 153.0.8010.47. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. The flaw is tracked under CWE-843: Access of Resource Using Incompatible Type. Google classifies the Chromium security severity as High. Exploitation requires user interaction, but no authentication or elevated privileges are needed. The vulnerability affects all Chromium-based browsers that share the ServiceWorker implementation until they merge the upstream fix.
Critical Impact
Successful exploitation allows arbitrary code execution inside the Chrome renderer sandbox through a single visit to a malicious web page.
Affected Products
- Google Chrome versions prior to 153.0.8010.47
- Chromium-based browsers embedding the vulnerable ServiceWorker code
- Desktop Chrome Stable channel on Windows, macOS, and Linux
Discovery Timeline
- 2026-09-15 - CVE-2026-91715 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91715
Vulnerability Analysis
CVE-2026-91715 is a type confusion flaw in Chrome's ServiceWorker implementation. Type confusion occurs when code accesses a memory object using a type incompatible with the object's actual type. In JavaScript engines and web platform components, this class of bug typically enables an attacker to read or write memory outside the intended object boundaries. The result is arbitrary read/write primitives inside the renderer process. ServiceWorkers run in a separate worker thread and mediate network requests, caching, and background events, making them a persistent attack surface once a page registers one. Google's advisory confirms that exploitation yields arbitrary code execution inside the sandbox.
Root Cause
The defect maps to CWE-843, where the ServiceWorker code path interprets an object as a type different from the one it was allocated as. This mismatch bypasses V8 or Blink type checks and permits operations on fields or vtables that do not exist on the true underlying object. Specific technical details are restricted in the Chromium Issue Tracker #558367547 until a majority of users have updated.
Attack Vector
An attacker hosts or injects a crafted HTML page that registers or interacts with a ServiceWorker in a way that triggers the type confusion. The victim only needs to visit the page in a vulnerable Chrome build. Delivery methods include malvertising, compromised sites, phishing links, and cross-site iframes. Code execution is confined to the renderer sandbox, so full compromise requires chaining a separate sandbox escape. Refer to the Google Chrome Stable Update advisory for vendor guidance.
Detection Methods for CVE-2026-91715
Indicators of Compromise
- Chrome renderer processes crashing with signatures referencing content::ServiceWorker or V8 type checks
- Unexpected ServiceWorker registrations under user profile directories from recently visited unfamiliar domains
- Child processes spawned by chrome.exe performing filesystem or network activity inconsistent with normal browsing
- Outbound connections from browser processes to newly registered or low-reputation domains shortly after page loads
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any build older than 153.0.8010.47
- Correlate browser crash telemetry with URL history to identify pages triggering renderer faults
- Alert on anomalous process lineage where chrome.exe renderer children invoke shell utilities or scripting hosts
- Hunt for suspicious ServiceWorker scripts in the Service Worker\ScriptCache directory of Chrome profiles
Monitoring Recommendations
- Ingest endpoint process, file, and DNS telemetry into a centralized data lake for retrospective hunting
- Enable Chrome Enterprise reporting to forward extension, download, and crash events to the SIEM
- Monitor perimeter and DNS logs for connections to domains associated with browser exploit kits
- Track patch compliance for Chrome using software inventory tooling and enforce minimum version policies
How to Mitigate CVE-2026-91715
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.47 or later on all Windows, macOS, and Linux endpoints
- Restart Chrome after the update so the patched binaries load in place of the running process
- Push the update through enterprise management tooling to guarantee coverage on managed devices
- Notify users to avoid untrusted links until patch deployment is verified
Patch Information
Google released the fix in the Chrome Stable channel at version 153.0.8010.47. Deployment details are documented in the Google Chrome Stable Update advisory. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi must pull the upstream patch and issue their own updates. Administrators should validate the running version by navigating to chrome://settings/help on a sample of endpoints after deployment.
Workarounds
- No official workaround exists; updating to the patched build is the only supported remediation
- Temporarily restrict browsing to trusted sites through web filtering while patch rollout is in progress
- Disable third-party ServiceWorker registration via enterprise policy if operationally acceptable
- Enforce Chrome auto-update via ChromeCleanupEnabled and UpdateDefault policies to prevent version drift
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Windows: query installed version from the registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
