CVE-2026-91728: Google Chrome V8 Engine RCE Vulnerability

CVE-2026-91728 Overview

CVE-2026-91728 is an integer overflow vulnerability [CWE-190] in the V8 JavaScript engine used by Google Chrome. The flaw affects all versions of Google Chrome prior to 153.0.8010.47. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. Google classified the underlying Chromium issue as High severity, and the NVD scoring places this vulnerability in the critical range due to network attack vector and scope change.

Critical Impact
Remote attackers can achieve arbitrary code execution inside the V8 sandbox through a single crafted web page, providing a foothold for further sandbox-escape chains.

Affected Products

Google Chrome versions prior to 153.0.8010.47
Chromium-based browsers embedding vulnerable V8 builds
Desktop channels (Windows, macOS, Linux) prior to the September 2026 stable update

Discovery Timeline

2026-09-15 - CVE-2026-91728 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91728

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. An integer overflow in V8 code paths allows attacker-controlled arithmetic to wrap around expected boundaries. The overflow enables memory corruption that a remote attacker can leverage for arbitrary code execution inside the V8 sandbox.

Exploitation requires the victim to load a crafted HTML page. Once triggered, the attacker can execute code within the renderer process. The scope change indicated in the CVSS metrics reflects that impact extends beyond the vulnerable component, since compromised V8 execution affects the broader browser context.

While execution is bounded by the V8 sandbox, attackers commonly chain integer overflows in V8 with separate sandbox-escape primitives to achieve full renderer or system compromise. The EPSS probability currently sits at 0.36%, but Chrome V8 flaws are historically weaponized quickly.

Root Cause

The root cause is an integer overflow [CWE-190] in V8. Arithmetic performed on attacker-influenced values exceeds the storage width of the target integer type, producing a truncated result. Subsequent memory operations use this truncated value as a size or index, leading to out-of-bounds memory access or heap corruption exploitable for code execution.

Attack Vector

The attack vector is network based and requires user interaction. An attacker hosts a malicious HTML page containing crafted JavaScript that triggers the vulnerable V8 code path. Delivery methods include direct navigation, malicious advertisements, compromised sites, or embedded iframes. No authentication is required.

Refer to the Chromium Issue Tracker Entry and the Google Chrome Stable Update for vendor technical context.

Detection Methods for CVE-2026-91728

Indicators of Compromise

Chrome renderer processes crashing with signatures consistent with V8 heap corruption or type confusion
Outbound connections from chrome.exe renderer children to previously unseen domains shortly after page load
Unexpected child processes spawned from Chrome renderer processes
Browser telemetry showing execution of obfuscated JavaScript with large typed-array or ArrayBuffer allocations

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 153.0.8010.47
Correlate web proxy logs against threat intelligence feeds for domains known to host V8 exploit kits
Monitor endpoint telemetry for anomalous behavior originating from browser renderer processes
Alert on Chrome crash dumps referencing V8 modules occurring across multiple users on similar URLs

Monitoring Recommendations

Enable Chrome enterprise reporting to centralize version, crash, and extension telemetry
Ingest browser process and network telemetry into a centralized analytics pipeline for correlation
Track the Google Chrome release blog and Chromium issue tracker for follow-on patches to V8
Monitor DNS and TLS SNI logs for domains that recently began serving heavily obfuscated JavaScript

How to Mitigate CVE-2026-91728

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all Windows, macOS, and Linux endpoints
Force-relaunch Chrome after update deployment to ensure the patched V8 build is loaded
Audit Chromium-based browsers and embedded WebViews for equivalent V8 patch levels
Prioritize patching for users who browse untrusted content or handle high-value assets

Patch Information

Google released the fix in the stable channel update announced in the Google Chrome Stable Update. Upgrade to Chrome 153.0.8010.47 or later. Enterprises using managed deployments should push the update through their standard software distribution mechanism and validate installation through Chrome's chrome://settings/help page or centralized reporting.

Workarounds

No official vendor workaround exists; patching is the only complete remediation
Restrict browsing to trusted sites through web proxy allowlists until patching completes
Deploy site isolation and enterprise policies that disable unnecessary JavaScript execution on high-risk endpoints
Consider temporary use of alternative browsers on unpatched systems handling sensitive workflows

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv