CVE-2026-91725: Google Chrome Information Disclosure Flaw

CVE-2026-91725 Overview

CVE-2026-91725 is an observable discrepancy vulnerability in the Cascading Style Sheets (CSS) implementation of Google Chrome. The flaw affects versions prior to 153.0.8010.47 and enables a remote attacker to leak sensitive information through a crafted HTML page. Chromium classifies the security severity as Medium. The weakness maps to [CWE-203: Observable Discrepancy], a class of side-channel issue where behavioral differences reveal information an attacker should not access. Successful exploitation requires user interaction, such as visiting a malicious page.

Critical Impact
A remote attacker can leak cross-origin or otherwise restricted information from a victim browser by exploiting timing or state discrepancies in CSS processing.

Affected Products

Google Chrome versions prior to 153.0.8010.47
Chromium-based browsers incorporating the vulnerable CSS engine
Desktop Stable channel builds across Windows, macOS, and Linux

Discovery Timeline

2026-09-15 - CVE-2026-91725 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91725

Vulnerability Analysis

The vulnerability resides in Chrome's CSS handling logic, where processing behavior differs measurably based on protected state. An attacker uses these observable differences to infer information that the browser's same-origin policy is intended to protect. The issue is classified under [CWE-203], which covers side-channel leaks caused by discrepancies in timing, resource usage, or rendering outcomes.

Exploitation requires a victim to load attacker-controlled HTML. The crafted page uses CSS constructs whose behavior varies with sensitive context, such as cross-origin resources, visited link state, or embedded content properties. By measuring these differences, the attacker recovers information from another origin without directly reading it. The attack complexity is high and requires user interaction, which constrains large-scale exploitation.

Root Cause

The root cause is an information-preserving side channel in the CSS engine. Style or layout computations complete in ways that reveal protected attributes to script or subsequent style queries. Because the discrepancy is a byproduct of legitimate rendering logic, standard content-security controls do not automatically neutralize it. Full technical detail is tracked in the Chromium Issue Tracker #518032534.

Attack Vector

The attack vector is network-based and delivered through a malicious or compromised web page. The attacker embeds cross-origin resources or leverages user-specific browser state, then observes CSS-driven behavior to extract information. No authentication is required, but the user must render the attacker's HTML in a vulnerable Chrome build.

No public proof-of-concept code is available for CVE-2026-91725. See the Chromium Issue Tracker #518032534 and the Google Chrome Stable Update for authoritative technical detail.

Detection Methods for CVE-2026-91725

Indicators of Compromise

Chrome desktop clients reporting a version below 153.0.8010.47 in enterprise inventory.
Web traffic to untrusted origins that serve pages with unusual CSS constructs referencing cross-origin resources or :visited state.
Browser telemetry showing sustained style recalculation or layout activity tied to iframes from third-party domains.

Detection Strategies

Inventory browser versions across managed endpoints and flag any Chrome instance below 153.0.8010.47.
Correlate web proxy logs with endpoint browser telemetry to identify users visiting pages that combine cross-origin embeds with heavy CSS-based measurement.
Alert on outbound requests that appear to exfiltrate small, structured payloads shortly after visits to untrusted pages, consistent with side-channel information leakage.

Monitoring Recommendations

Ingest browser version data and web proxy logs into a centralized analytics platform for correlation and historical review.
Monitor Chrome update compliance and set thresholds that alert when out-of-date builds persist beyond the patch window.
Track access to sensitive internal web applications from browsers that have not yet been patched to 153.0.8010.47 or later.

How to Mitigate CVE-2026-91725

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all managed endpoints.
Force a browser restart after update deployment to ensure the vulnerable process is replaced.
Verify that Chromium-based enterprise browsers have absorbed the upstream fix before treating them as remediated.

Patch Information

Google addressed CVE-2026-91725 in the Stable channel update announced in the Google Chrome Stable Update. Administrators should push Chrome 153.0.8010.47 or later through their standard software distribution channel and confirm rollout using endpoint inventory data.

Workarounds

Restrict browsing to trusted origins on unpatched systems using web filtering or enterprise policy.
Disable third-party iframes and cross-origin embeds on sensitive internal applications until patching completes.
Enforce strict Content-Security-Policy and Cross-Origin-Resource-Policy headers on high-value web properties to reduce cross-origin exposure.

bash

# Configuration example: enforce Chrome auto-update and minimum version via policy
# Windows (registry) - require Chrome to remain on the latest Stable channel
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Google\Update\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v Update /t REG_DWORD /d 1 /f

# macOS - force update check now
sudo /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot -userInitiated YES

# Linux (Debian/Ubuntu) - update to patched build
sudo apt-get update && sudo apt-get install --only-upgrade google-chrome-stable