CVE-2026-91721: Google Chrome Use After Free Vulnerability

CVE-2026-91721 Overview

CVE-2026-91721 is a use-after-free vulnerability [CWE-416] in the Internals component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.47. A remote attacker can exploit the issue by serving a crafted HTML page to a targeted user. Successful exploitation allows arbitrary code execution outside the Chrome sandbox. Google's Chromium team classifies the underlying security severity as Critical. The National Vulnerability Database (NVD) rates the issue High with a CVSS 3.1 score of 8.8. Exploitation requires user interaction, typically visiting an attacker-controlled web page. No public proof-of-concept exploit is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Remote attackers can achieve arbitrary code execution outside the Chrome sandbox by luring a user to a crafted HTML page.

Affected Products

Google Chrome versions prior to 153.0.8010.47 (Desktop, Stable channel)
Chromium-based browsers sharing the vulnerable Internals code
All operating systems supported by the Chrome Desktop Stable channel

Discovery Timeline

2026-09-15 - CVE-2026-91721 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91721

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the Internals component of Chrome. Use-after-free bugs occur when code references heap memory after that memory has been released. An attacker who controls the freed allocation can influence subsequent reads or writes against that memory. In Chrome, such flaws frequently enable arbitrary code execution inside the renderer. Chromium's advisory indicates this specific flaw allows the attacker to escape the sandbox, moving execution into the more privileged browser process context. Sandbox escapes convert a browsing session into a full workstation compromise vector.

Root Cause

The root cause is improper object lifetime management within Chrome's Internals code. An object is freed while a reference to it remains reachable and later dereferenced. Google has not publicly detailed the affected function or object type at this stage. The Chromium issue tracker entry for the bug remains restricted pending broader patch adoption.

Attack Vector

Exploitation requires a user to load a crafted HTML page under attacker control. Delivery vectors include phishing links, malicious advertisements, watering-hole compromises, and cross-site iframes on otherwise trusted sites. Once loaded, the page triggers the vulnerable code path in the Internals component. Successful exploitation grants code execution outside the renderer sandbox on the victim host.

No verified public exploit code is currently available. Refer to the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for vendor detail as it becomes public.

Detection Methods for CVE-2026-91721

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters on macOS and Linux
Chrome renderer or browser process crashes with heap corruption signatures preceding suspicious activity
Outbound network connections from Chrome to untrusted infrastructure immediately after visiting a new URL
Installed Chrome versions below 153.0.8010.47 across managed endpoints

Detection Strategies

Inventory installed Chrome versions across the estate and flag hosts running below 153.0.8010.47
Alert on anomalous process lineage where chrome.exe (or platform equivalent) launches non-browser binaries
Correlate Chrome crash telemetry with subsequent process creation or persistence events on the same host
Monitor DNS and HTTP telemetry for traffic to newly observed domains loaded through browser sessions

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized analytics platform for retrospective search
Track Chrome auto-update status and enforce version compliance through configuration management tooling
Enable browser crash reporting to a centralized location to identify potential exploitation attempts
Review web proxy logs for user visits to unknown domains shortly before endpoint anomalies

How to Mitigate CVE-2026-91721

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all managed endpoints
Restart Chrome after the update completes to ensure the patched binaries are loaded
Verify that Chromium-based browsers used in the environment have integrated the upstream fix
Communicate the risk to end users and instruct them to avoid untrusted links until patched

Patch Information

Google released the fix in the Chrome Stable channel version 153.0.8010.47. Details are published in the Google Chrome Desktop Update advisory. Enterprise administrators should deploy the update through standard patch management channels and validate installation on all endpoints.

Workarounds

No vendor-supplied workaround exists; apply the patch as the primary mitigation
Restrict browsing to trusted sites through web proxy or DNS filtering while patch deployment is in progress
Disable or restrict third-party advertising and script execution using enterprise browser policies where feasible
Segment high-value endpoints from general web browsing until the update is confirmed installed

bash

# Verify Chrome version on Linux and macOS endpoints
google-chrome --version
# Expected output: Google Chrome 153.0.8010.47 or higher

# Windows PowerShell version check
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion