CVE-2026-91730 Overview
CVE-2026-91730 is an incomplete cleanup vulnerability [CWE-459] in the GetUserMedia implementation of Google Chrome before version 153.0.8010.47. The flaw allows a remote attacker who has already compromised the renderer process to obtain cross-origin data through a crafted HTML page and social engineering. Chromium classifies the security severity as Medium, though the CVSS score reflects a lower base risk due to the high attack complexity and required user interaction.
Critical Impact
Successful exploitation exposes cross-origin data from the browser, undermining the same-origin policy that isolates web content between sites.
Affected Products
- Google Chrome versions prior to 153.0.8010.47
- Chromium-based browsers sharing the affected GetUserMedia implementation
- Desktop stable channel builds released before the September 2026 update
Discovery Timeline
- 2026-09-15 - CVE-2026-91730 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91730
Vulnerability Analysis
The vulnerability resides in Chrome's GetUserMedia API, which brokers access to microphone and camera devices from web content. According to the Chromium advisory, the implementation performs incomplete cleanup of internal state or resources associated with media capture. This residual data can be reached from a renderer process that an attacker already controls, enabling read access to information belonging to another origin.
Exploitation is not straightforward. The attacker must first compromise the renderer process through a separate vulnerability, then trick the user into interacting with a crafted HTML page. This chained requirement, combined with user interaction, keeps the base score in the low range even though the outcome is a same-origin policy bypass.
Root Cause
The root cause is classified as CWE-459: Incomplete Cleanup. When the GetUserMedia pathway finishes processing, it fails to fully release or sanitize associated resources. State that should have been discarded remains accessible in memory reachable by the renderer, providing a path for a compromised renderer to read data across origin boundaries.
Attack Vector
The attack is network-based but requires a compromised renderer process as a prerequisite. The attacker delivers a crafted HTML page and uses social engineering to induce the user to grant media access or otherwise interact with the page. Once the renderer executes the crafted content, the incomplete cleanup allows the attacker to harvest cross-origin data. See the Chromium Issue Tracker #543640868 for developer-facing details.
No public proof-of-concept exploit code is available for this issue.
Detection Methods for CVE-2026-91730
Indicators of Compromise
- Chrome desktop clients still reporting versions below 153.0.8010.47 in endpoint inventory data.
- Unexpected getUserMedia permission prompts on domains with no legitimate need for camera or microphone access.
- Renderer process crashes or anomalies preceding suspicious outbound requests carrying cross-origin content.
Detection Strategies
- Inventory installed browser versions across managed endpoints and flag hosts running Chrome builds earlier than 153.0.8010.47.
- Correlate browser telemetry with process-level events to surface renderer compromises that precede media API activity.
- Monitor for HTML content served from low-reputation domains that requests media permissions immediately after page load.
Monitoring Recommendations
- Track browser update compliance through endpoint management tooling and alert on stale installations.
- Ingest browser and web filtering logs into a central analytics platform to identify social engineering campaigns targeting user interaction with getUserMedia.
- Review DNS and HTTP proxy telemetry for repeated visits to unfamiliar sites that trigger camera or microphone prompts.
How to Mitigate CVE-2026-91730
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.47 or later on all managed desktops.
- Restart Chrome after applying the update to ensure the patched binary is loaded into memory.
- Verify that automatic browser updates are enabled and unblocked by group policy or network filtering.
Patch Information
Google addressed CVE-2026-91730 in the Chrome stable channel update documented in the Google Chrome Releases Blog. Administrators should deploy Chrome 153.0.8010.47 or higher across Windows, macOS, and Linux endpoints. Chromium-based browsers built on earlier versions should incorporate the upstream fix referenced in Chromium Issue Tracker #543640868.
Workarounds
- Restrict camera and microphone permissions by default through enterprise browser policy until patches are deployed.
- Educate users to decline getUserMedia prompts on unfamiliar sites and to report unexpected permission requests.
- Block access to untrusted domains through DNS filtering or secure web gateway policies to limit social engineering exposure.
# Configuration example: enforce Chrome auto-update and disable media by default via policy
# Windows registry (HKLM) enforcing default deny for camera and microphone
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultAudioCaptureSetting /t REG_DWORD /d 2 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultVideoCaptureSetting /t REG_DWORD /d 2 /f
# Verify installed Chrome version on Linux
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
