CVE-2026-91729: Google Chrome Use After Free Vulnerability

CVE-2026-91729 Overview

CVE-2026-91729 is a use-after-free vulnerability in the DigitalCredentials component of Google Chrome. The flaw affects versions prior to 153.0.8010.47 and enables a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires user interaction with a crafted HTML page, typically delivered through social engineering. Chromium's security team rated the underlying issue as High severity, while the NVD scoring reflects the sandbox escape impact.

Critical Impact
Successful exploitation allows arbitrary code execution outside the Chrome sandbox, giving attackers a foothold on the underlying operating system through a single malicious web page.

Affected Products

Google Chrome versions prior to 153.0.8010.47 (Desktop, Stable channel)
Chromium-based browsers incorporating the vulnerable DigitalCredentials code path
All supported desktop operating systems running affected Chrome builds

Discovery Timeline

2026-09-15 - CVE-2026-91729 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91729

Vulnerability Analysis

The vulnerability resides in Chrome's DigitalCredentials API, which handles credential presentation flows initiated from web content. A use-after-free condition [CWE-416] occurs when the component references heap memory after it has been released. An attacker who controls the freed object layout can hijack execution flow when Chrome dereferences the stale pointer.

Because the affected code operates in a privileged browser process rather than a sandboxed renderer, successful exploitation escapes the Chrome sandbox. This removes the primary containment layer that normally limits the impact of a compromised web page. The attacker gains the ability to run native code with the privileges of the browser process.

User interaction is required. The victim must load a crafted HTML page and perform an action that triggers the vulnerable credential flow, which is why social engineering is central to the attack chain.

Root Cause

The root cause is improper object lifetime management inside the DigitalCredentials implementation. An object is freed while another code path retains a reference to it, and that reference is later used without validation. This is a classic memory safety defect in C++ code that lacks strict ownership tracking.

Attack Vector

An attacker hosts a malicious HTML page and lures a target to visit it, often through phishing, malvertising, or a compromised site. The page invokes the vulnerable DigitalCredentials code path and manipulates object allocation and release to control the freed memory. When Chrome accesses the dangling pointer, the attacker redirects execution to shellcode that runs outside the sandbox. Public exploit code has not been observed at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Chromium Issue Tracker #557206809 for internal details as they become public.

Detection Methods for CVE-2026-91729

Indicators of Compromise

Chrome renderer or browser process crashes with access violation signatures involving DigitalCredentials
Unexpected child processes spawned by chrome.exe immediately after a browsing session
Outbound connections from Chrome to newly registered or low-reputation domains hosting credential-request pages
New persistence artifacts (Run keys, scheduled tasks, LaunchAgents) created shortly after Chrome activity

Detection Strategies

Inventory installed Chrome versions across the fleet and alert on any build below 153.0.8010.47
Monitor for anomalous process lineage where Chrome spawns interpreters such as powershell.exe, cmd.exe, or bash
Correlate browser crash telemetry with subsequent code execution or file-write events on the same host
Hunt for HTML pages calling the Digital Credentials API from untrusted origins in web proxy logs

Monitoring Recommendations

Enable enterprise reporting for Chrome crash and exploit protection events via the Google Chrome Stable Update advisory guidance
Forward endpoint process telemetry to a centralized SIEM or data lake for cross-host correlation
Track Chrome version drift over time and prioritize hosts that lag more than one release behind stable

How to Mitigate CVE-2026-91729

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on every managed endpoint
Force a browser restart after deployment so the patched binaries load into memory
Push updates to Chromium-based browsers as their vendors publish rebased builds
Reinforce user awareness that credential prompts on unfamiliar sites should be declined

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. The patched version is 153.0.8010.47. Enterprise administrators should validate that Chrome auto-update is enabled and that the UpdatePolicy group policy permits timely rollout.

Workarounds

Restrict access to the Digital Credentials API through enterprise policy where operationally acceptable
Deploy site isolation and enhanced Safe Browsing to reduce the reach of malicious pages
Block known malicious and newly registered domains at the web proxy or DNS layer until patching completes

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version