CVE-2026-91716: Google Chrome Use After Free Vulnerability

CVE-2026-91716 Overview

CVE-2026-91716 is a use-after-free vulnerability in the Auth component of Google Chrome prior to version 153.0.8010.47. A remote attacker can execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. Chromium security engineering rated the underlying issue as High severity, and the NVD assigns it a critical rating due to the sandbox escape and network attack vector. The flaw is tracked under CWE-416: Use After Free and requires only that the victim load attacker-controlled content in Chrome.

Critical Impact
Remote attackers can achieve arbitrary code execution outside the Chrome sandbox through a single crafted web page, bypassing the browser's primary isolation boundary.

Affected Products

Google Chrome for Desktop versions prior to 153.0.8010.47
Chromium-based browsers that inherit the vulnerable Auth component code
All operating systems on which vulnerable Chrome builds are deployed (Windows, macOS, Linux)

Discovery Timeline

2026-09-15 - CVE-2026-91716 published to NVD following the Chrome Stable channel update
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91716

Vulnerability Analysis

The vulnerability resides in Chrome's Auth component, which handles browser authentication flows such as HTTP authentication challenges and related credential prompts. A use-after-free condition allows attacker-controlled content to reference memory that has already been released. Because the flaw permits code execution outside the sandbox, successful exploitation grants attackers the privileges of the browser process on the host operating system. This class of bug is a preferred target for exploit chains because it bypasses the Chromium multi-process isolation model that normally contains renderer compromises.

Root Cause

The defect is a CWE-416 use-after-free within the Auth subsystem. Object lifetime is mismanaged so that a pointer continues to be dereferenced after the underlying memory is freed. When an attacker controls allocations that reuse the freed region, they can influence virtual function pointers or other control data reachable through the dangling reference. Detailed root-cause information is tracked in Chromium Issue Tracker #554558368.

Attack Vector

Exploitation requires a victim to visit a crafted HTML page under attacker control. The page triggers the authentication code path that frees an object and then re-enters logic that continues to use it. No privileges are required on the target system, but user interaction is needed to load the page. Because the resulting code execution occurs outside the sandbox, the attacker does not need a separate sandbox escape primitive to reach the host. Verified proof-of-concept code is not publicly available at the time of publication.

Detection Methods for CVE-2026-91716

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as command shells, powershell.exe, or scripting hosts shortly after web navigation
Chrome renderer or broker process crashes with heap corruption signatures logged in operating system crash reporters
Outbound connections from the Chrome process tree to unfamiliar domains immediately after visiting untrusted content
Presence of Chrome installations at versions earlier than 153.0.8010.47 in endpoint inventory data

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 153.0.8010.47 for prioritized remediation
Alert on process lineage where chrome.exe (or platform equivalents) is the parent of interpreters, cmd.exe, or living-off-the-land binaries
Correlate browser crash telemetry with subsequent process creation or persistence activity on the same host
Monitor web proxy and DNS logs for user navigation to newly registered or low-reputation domains preceding endpoint anomalies

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a central data lake to enable retrospective hunting for browser-initiated exploitation
Track patch compliance for Google Chrome as a first-class metric and reconcile against the Google Chrome Stable Update advisory
Enable browser crash reporting to security operations so that heap corruption events feed identification workflows

How to Mitigate CVE-2026-91716

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all managed endpoints
Restart Chrome after the update to ensure the patched binaries are loaded into memory
Push the update to Chromium-based browsers used in the environment once vendors ship equivalent fixes
Restrict browsing to trusted sites for high-risk users until patch deployment is verified

Patch Information

Google released the fix in the Chrome Stable channel at version 153.0.8010.47. Administrators should reference the Google Chrome Stable Update advisory and the Chromium Issue Tracker #554558368 for release details. Enterprise deployments using Chrome Enterprise policies should force an update and browser relaunch through management tooling.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation
Reduce exposure by enforcing Safe Browsing enhanced protection and blocking navigation to uncategorized or newly registered domains at the web proxy
Apply application allowlisting to prevent Chrome child processes from launching interpreters or unauthorized binaries
Segment high-value workstations from general internet browsing where feasible

bash

# Configuration example: force Chrome update on Windows via Group Policy registry keys
# Enforces automatic updates and rapid rollout of the fixed build
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f

# macOS: verify installed Chrome version meets or exceeds the patched build
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux (Debian/Ubuntu): update to the fixed Chrome package
sudo apt-get update && sudo apt-get install --only-upgrade google-chrome-stable