CVE-2026-91719: Google Chrome XML Code Injection Vulnerability

CVE-2026-91719 Overview

CVE-2026-91719 is a code injection vulnerability in the XML component of Google Chrome versions prior to 153.0.8010.47. A remote attacker can bypass the web origin policy by serving a crafted HTML page to a targeted user. Chromium classifies the security severity as Low. The flaw is tracked under CWE-94: Improper Control of Generation of Code and affects the Stable channel of Chrome across supported desktop platforms.

Critical Impact
Successful exploitation lets an attacker circumvent the same-origin boundary through crafted XML content, exposing cross-origin data to attacker-controlled script contexts.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.47
Chromium-based browsers embedding vulnerable versions of the XML component
Downstream distributions tracking the Chrome Stable channel prior to the September 2026 update

Discovery Timeline

2026-09-15 - CVE-2026-91719 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91719

Vulnerability Analysis

The vulnerability resides in Chrome's XML handling path. An attacker who serves a crafted HTML page can cause the browser to process XML content in a way that produces code execution outside the intended origin boundary. Because the flaw enables web origin policy bypass, script or data associated with one origin can influence execution in another origin's context.

The issue is classified under CWE-94, Improper Control of Generation of Code. The Chromium security team rated the severity as Low, which typically indicates limited direct impact but non-trivial cross-origin exposure. Public exploitation has not been reported, and no proof-of-concept has been released at the time of publication.

Root Cause

The root cause is improper isolation of XML-derived content when it is projected into a document context. Chrome's XML parser accepts constructs from a crafted page that, once rendered, are treated with privileges inconsistent with their true origin. This mishandling collapses the boundary the same-origin policy is intended to enforce.

Attack Vector

Exploitation requires a victim to load a malicious or attacker-controlled HTML page in a vulnerable Chrome build. The page delivers crafted XML that triggers the injection primitive. No privileges are required on the target host. Delivery vehicles include phishing links, malvertising, and compromised third-party content embedded on legitimate sites.

Technical details are limited to the vendor advisory. See the Google Chrome Stable Channel Update and Chromium Issue Tracker #542115030 for authoritative references.

Detection Methods for CVE-2026-91719

Indicators of Compromise

Chrome browser processes running builds earlier than 153.0.8010.47 after the vendor patch date
Outbound requests to attacker-hosted pages serving unusual application/xml or text/xml responses embedded within HTML documents
Unexpected cross-origin fetches or DOM access patterns originating from a renderer process shortly after visiting an untrusted page

Detection Strategies

Inventory installed Chrome versions across the fleet and flag hosts running versions below 153.0.8010.47
Inspect proxy and web filter logs for HTML pages that embed or reference crafted XML payloads from low-reputation domains
Correlate browser telemetry with EDR process events to identify anomalous renderer child processes accessing data outside expected origins

Monitoring Recommendations

Enable browser management telemetry to report Chrome version, channel, and update status back to a central console
Alert on delays in Chrome auto-update completion beyond the organization's patch SLA
Monitor for user reports of unexpected authentication prompts or session anomalies immediately after visiting external links

How to Mitigate CVE-2026-91719

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binaries are loaded into memory
Audit Chromium-based applications and Electron-derived tooling for embedded browser versions that require rebasing

Patch Information

Google addressed CVE-2026-91719 in the Chrome Stable channel update referenced in the Google Chrome Stable Channel Update advisory. The fix is included in Chrome 153.0.8010.47 and later. Additional engineering context is tracked in Chromium Issue #542115030.

Workarounds

Restrict browsing to trusted destinations using enterprise web filtering until patches are deployed
Enforce Chrome auto-update through group policy or MDM to reduce exposure windows on managed endpoints
Advise users to avoid clicking unsolicited links and to report suspicious pages that trigger browser errors or unexpected prompts