CVE-2026-91724: Google Chrome Use After Free Vulnerability

CVE-2026-91724 Overview

CVE-2026-91724 is a use-after-free vulnerability [CWE-416] in the Input component of Google Chrome versions prior to 153.0.8010.47. A remote attacker who has already compromised the renderer process can leverage the flaw to execute arbitrary code outside the browser sandbox. Exploitation requires user interaction with a crafted HTML page. Google rates the Chromium security severity as High.

Successful exploitation breaks Chrome's sandbox isolation, giving an attacker code execution at the level of the browser process. That access can lead to persistent malware installation, credential theft, or lateral movement from a browsing session.

Critical Impact
Sandbox escape via a crafted HTML page enables arbitrary code execution on the host after renderer compromise.

Affected Products

Google Chrome versions prior to 153.0.8010.47
Chromium-based browsers that share the vulnerable Input component code
Desktop channels (Windows, macOS, Linux) served by the Stable channel update

Discovery Timeline

2026-09-15 - CVE-2026-91724 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91724

Vulnerability Analysis

The flaw resides in the Input component of Chrome, which handles input event routing between the renderer and browser processes. A use-after-free condition occurs when memory is referenced after being released, allowing an attacker to reuse the freed allocation with attacker-controlled data.

Exploitation requires a two-stage attack chain. The attacker must first compromise the renderer process, typically through a separate memory corruption bug, then trigger the Input use-after-free to escape the sandbox. Successful exploitation yields arbitrary code execution in the higher-privileged browser process.

The attack requires user interaction, such as visiting a crafted page. The scope is marked as changed because the impact crosses the sandbox trust boundary.

Root Cause

The root cause is improper object lifetime management in the Input handling code. A dangling pointer to a freed input-related object is later dereferenced during event processing. When the attacker reallocates the freed memory with controlled contents before the dereference, control-flow hijacking becomes possible.

Attack Vector

The attacker hosts a crafted HTML page and lures a victim to load it in a vulnerable Chrome build. After compromising the renderer through a chained bug, the exploit triggers the Input component free-then-use sequence to pivot into the browser process. This yields code execution outside the sandbox on the victim's host. See the Chromium Issue #552283275 tracker for reference.

No public proof-of-concept or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-91724

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters shortly after browsing activity
Unsigned or unusual DLLs loaded into chrome.exe browser process memory
Outbound network connections from Chrome to newly registered or low-reputation domains hosting HTML payloads
Chrome crash reports referencing the Input component or renderer-to-browser IPC handlers

Detection Strategies

Monitor endpoint telemetry for anomalous process lineage where chrome.exe acts as parent to non-browser processes
Correlate browser crash events with subsequent process creation or file-write activity in user profile directories
Inspect web proxy logs for HTML content triggering repeated renderer crashes across multiple users

Monitoring Recommendations

Track installed Chrome versions across managed endpoints and flag any build below 153.0.8010.47
Enable browser telemetry forwarding to a centralized SIEM for crash and exploit-attempt visibility
Alert on execution of downloaded payloads originating from browser cache or temp directories

How to Mitigate CVE-2026-91724

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all managed endpoints
Restart Chrome after the update to ensure the patched binaries are loaded into memory
Audit any Chromium-based applications and apply vendor updates as they integrate the upstream fix

Patch Information

Google released the fix in Chrome Stable 153.0.8010.47. Details are available in the Google Chrome Stable Update release notes. Enterprise administrators should push the update through Chrome Browser Enterprise, Group Policy, or their software distribution platform.

Workarounds

Enforce Chrome auto-update through enterprise policy to prevent version drift
Restrict browsing to trusted sites via URL allow-listing until patching is complete
Deploy application-layer isolation such as remote browser isolation for high-risk users

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version