CVE-2026-91727: Google Chrome RCE Vulnerability

CVE-2026-91727 Overview

CVE-2026-91727 is an incorrect reference resolution vulnerability in the Extensions component of Google Chrome on macOS. The flaw affects Chrome versions prior to 153.0.8010.47 and is categorized under [CWE-706] (Use of Incorrectly-Resolved Name or Reference). An attacker who has already compromised the renderer process can leverage a local program to execute arbitrary code outside the Chrome sandbox. Google classified this issue with a Chromium security severity of High.

Critical Impact
Successful exploitation results in sandbox escape and arbitrary code execution on the host macOS system, breaking Chrome's primary isolation boundary.

Affected Products

Google Chrome for macOS prior to 153.0.8010.47
Apple macOS (host operating system)
Chromium-based builds sharing the vulnerable Extensions code path

Discovery Timeline

2026-09-15 - CVE-2026-91727 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91727

Vulnerability Analysis

The vulnerability resides in how the Extensions subsystem in Chrome on macOS resolves references to underlying resources or programs. Incorrect reference resolution ([CWE-706]) occurs when a component uses a name or path to access a resource, but the resolved target differs from the intended one. In this case, the mismatch permits execution to cross the renderer sandbox boundary. Exploitation requires that an attacker first compromise the renderer process, typically through a separate memory-corruption or logic bug. Once inside the renderer, the attacker abuses the Extensions reference-resolution flaw to invoke a local program with privileges outside the sandbox.

Root Cause

The root cause is improper validation of the target that an Extensions-related reference resolves to on macOS. The Extensions component trusts a resolved reference without confirming that it points to an approved, sandbox-safe target. This assumption enables a compromised renderer to redirect execution to a local program of the attacker's choosing. Google addressed the issue in Chrome 153.0.8010.47 via changes tracked in Chromium Issue #516893912.

Attack Vector

The attack vector is local and requires a chained precondition. The attacker must already control the renderer process, which is normally confined by the Chrome sandbox on macOS. From that position, the attacker triggers the Extensions code path that mis-resolves a reference, causing a local program to be executed outside the sandbox. No user interaction is required beyond the initial compromise that yields renderer control. Because the sandbox is bypassed, the impact extends to confidentiality, integrity, and availability of resources on the host. Refer to the Chrome Releases advisory for vendor-confirmed exploitation preconditions.

No public proof-of-concept or exploit code has been released for CVE-2026-91727. Technical specifics remain restricted in the Chromium issue tracker at the time of publication.

Detection Methods for CVE-2026-91727

Indicators of Compromise

Chrome renderer processes on macOS spawning unexpected child processes or invoking local binaries outside the sandbox profile.
Execution of local programs whose parent process chain traces back to Google Chrome Helper (Renderer).
Chrome installations reporting a version earlier than 153.0.8010.47 in enterprise inventory data.

Detection Strategies

Monitor process-lineage telemetry for anomalous child processes descending from Chrome Helper renderer processes on macOS endpoints.
Correlate Extensions installation and update events with subsequent local program executions initiated by Chrome.
Alert on Chrome version drift below the patched build 153.0.8010.47 across the managed fleet.

Monitoring Recommendations

Ingest macOS Endpoint Security Framework (ESF) exec and fork events for Chrome processes into a centralized analytics pipeline.
Track Chrome auto-update status and flag hosts that fail to reach the fixed version within the patch window.
Review installed Chrome extensions for unexpected additions and disable side-loaded or unmanaged extensions.

How to Mitigate CVE-2026-91727

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 153.0.8010.47 or later.
Enforce Chrome auto-update via mobile device management (MDM) policies to close the exposure window on unmanaged systems.
Audit and remove non-essential or untrusted browser extensions, since exploitation is scoped to the Extensions component.

Patch Information

Google released the fix in the Chrome Stable channel update announced on the Chrome Releases blog. The corrected build is 153.0.8010.47 for macOS. The underlying change is tracked as Chromium Issue #516893912. Organizations should validate deployment by querying the reported Chrome version on each macOS host.

Workarounds

Restrict Chrome extension installation to an allowlist managed through enterprise policy (ExtensionInstallAllowlist).
Disable extensions entirely on high-value macOS endpoints until the patched build is deployed.
Apply least-privilege user accounts on macOS to limit the impact of any local program executed outside the sandbox.

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Example Chrome enterprise policy to restrict extensions (JSON)
# Path: /Library/Managed Preferences/com.google.Chrome.plist
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": ["<approved-extension-id>"]
}