CVE-2026-91718: Google Chrome Use After Free Vulnerability

CVE-2026-91718 Overview

CVE-2026-91718 is a use-after-free vulnerability in the Core component of Google Chrome prior to version 153.0.8010.47. A remote attacker can execute arbitrary code outside the browser sandbox by convincing a user to visit a crafted HTML page. The flaw is classified under CWE-416: Use After Free. Chromium's security team rates the underlying issue as High severity, and the National Vulnerability Database records a Critical rating due to the sandbox escape impact.

Critical Impact
Successful exploitation grants arbitrary code execution outside the Chrome sandbox, bypassing a primary browser security boundary and giving attackers a foothold on the host operating system.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.47
Chromium-based browsers that share the vulnerable Core component
All supported desktop platforms delivered through the Chrome Stable channel

Discovery Timeline

2026-09-15 - CVE-2026-91718 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91718

Vulnerability Analysis

The vulnerability is a use-after-free condition in Chrome's Core component. Use-after-free flaws occur when code references heap memory after that memory has already been released. An attacker who controls object lifetimes can place attacker-influenced data into the freed region and cause the dangling reference to operate on that data.

In this case, the freed object is reachable through content rendered from a crafted HTML page. Because the exploitation path leads to code execution outside the sandbox, the vulnerability crosses a trust boundary that Chromium is explicitly designed to enforce. Exploitation requires user interaction, typically visiting an attacker-controlled or compromised web page.

Root Cause

The root cause is improper lifetime management inside the Core component. An internal object is freed while other code paths still hold references to it. When those stale references are dereferenced, the process operates on memory that may already have been reallocated for a different purpose, enabling attacker-controlled data to influence subsequent execution.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures the victim to visit it through phishing, malvertising, or a compromised site. Because the outcome is arbitrary code execution outside the sandbox, an attacker can chain this flaw into initial access and post-exploitation activity on the host. No verified public exploit or proof-of-concept has been published at the time of this writing.

No verified exploit code is available. See the Chromium Issue Tracker Entry and the Chrome Releases Update Announcement for vendor-supplied technical context.

Detection Methods for CVE-2026-91718

Indicators of Compromise

Chrome renderer or browser process crashes with heap corruption signatures shortly after visiting an unfamiliar URL.
Unexpected child processes spawned by chrome.exe outside the normal helper process tree.
Outbound connections from Chrome-hosted processes to previously unseen infrastructure immediately following browsing activity.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.47.
Correlate browser-initiated process creation with file writes to user-writable directories such as %APPDATA% or /tmp.
Monitor Chrome crash telemetry for repeated faults in the Core component, which may indicate exploitation attempts or unstable exploits.

Monitoring Recommendations

Ingest browser process telemetry, DNS, and HTTP proxy logs into a central analytics platform to correlate suspicious page visits with post-visit host behavior.
Alert on Chrome processes launching scripting interpreters, powershell.exe, cmd.exe, or bash shortly after network activity.
Track patch compliance via endpoint management tooling and generate weekly reports on browsers still exposed to CVE-2026-91718.

How to Mitigate CVE-2026-91718

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on every managed endpoint.
Restart the browser after updating so that patched binaries replace running processes.
Verify Chromium-based third-party browsers have adopted the corresponding upstream fix before considering the environment remediated.

Patch Information

Google released the fix in the Chrome Stable channel update announced in the Chrome Releases Update Announcement. Administrators should confirm the deployed build number is at least 153.0.8010.47. Additional technical context is available in the Chromium Issue Tracker Entry.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation.
Reduce exposure by restricting browsing to trusted sites and enforcing web filtering at the network egress until patches are deployed.
Enable site isolation and keep enterprise policies that block execution of downloaded content from untrusted zones.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux endpoints
google-chrome --version