CVE-2026-91731: Google Chrome RCE Vulnerability

CVE-2026-91731 Overview

CVE-2026-91731 is a type confusion vulnerability in the Compositing component of Google Chrome prior to version 153.0.8010.47. A remote attacker can execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The flaw is tracked under CWE-843: Access of Resource Using Incompatible Type and carries a Chromium security severity rating of High. Successful exploitation requires user interaction, such as visiting an attacker-controlled site. Google has addressed the issue in the Stable channel update for desktop.

Critical Impact
Remote attackers can achieve arbitrary code execution inside the Chrome renderer sandbox by delivering a crafted HTML page to a target user.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.47
Chromium-based browsers sharing the vulnerable Compositing code
Downstream builds pending upstream patch adoption

Discovery Timeline

2026-09-15 - CVE-2026-91731 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91731

Vulnerability Analysis

The vulnerability is a type confusion condition in Chrome's Compositing subsystem. Compositing is responsible for combining layered graphical content produced by the renderer before the browser paints frames to the screen. When the component operates on an object under an assumption of one type while it is actually of another, memory is interpreted incorrectly. This mismatch can lead to controlled memory access, corruption of internal pointers, and ultimately arbitrary code execution within the renderer process.

Execution occurs inside the sandbox, meaning direct system compromise requires chaining with a sandbox escape. Even so, renderer-level code execution grants access to browser session data, cookies, cross-origin content via bypasses, and a strong foothold for further exploitation.

Root Cause

Type confusion (CWE-843) arises when code casts or dispatches on an object without validating its runtime type. In the Compositing pipeline, mismatched type assumptions on layer, quad, or graphics resource objects allow attacker-influenced data to be treated as a different structure. Field offsets and virtual dispatch tables become attacker-controlled, enabling memory corruption primitives.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page that drives the Compositing code path through specific rendering sequences, likely involving canvas, CSS transforms, WebGL, or layer promotion. Rendering the page triggers the type confusion, allowing the attacker to execute code within the renderer process. See Chromium Issue #523554372 and the Google Chrome Stable Update for advisory details.

Detection Methods for CVE-2026-91731

Indicators of Compromise

Chrome renderer processes crashing with signatures pointing to cc:: (compositor) or viz:: frames.
Outbound connections from browser child processes to unexpected external hosts following visits to untrusted URLs.
Unexpected child processes spawned by chrome.exe after rendering third-party pages.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build prior to 153.0.8010.47.
Correlate web proxy logs of visited domains with browser crash telemetry to identify suspicious pages triggering renderer faults.
Monitor Windows Error Reporting and macOS crash logs for repeated Chrome renderer exceptions tied to compositing modules.

Monitoring Recommendations

Enable enterprise browser telemetry through Chrome Enterprise reporting and forward events to a central analytics platform.
Track process creation events where Chrome renderer processes launch shells, scripting hosts, or code interpreters.
Alert on writes to persistence locations initiated by Chrome child processes following web browsing activity.

How to Mitigate CVE-2026-91731

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all Windows, macOS, and Linux endpoints.
Force-restart Chrome after deployment to ensure the patched binary is loaded across all user sessions.
Apply the corresponding upstream fix to any Chromium-based browsers in use, such as Edge, Brave, or Vivaldi, once vendors ship updates.

Patch Information

Google released the fix in the Stable channel update announced in the Google Chrome Stable Update. Administrators should confirm managed Chrome installations receive the update via Chrome Enterprise policies or the platform's package manager. Technical tracking is available in Chromium Issue #523554372.

Workarounds

Restrict browsing on unpatched hosts to a curated allowlist of trusted internal sites until updates are applied.
Enforce Chrome auto-update policies through group policy or MDM to prevent stale installations.
Consider temporarily disabling hardware acceleration on unpatched hosts to reduce reachability of some compositing code paths, accepting the performance tradeoff.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Enforce minimum version via Chrome Enterprise policy (JSON snippet)
# Deploy through group policy or MDM
{
  "TargetVersionPrefix": "153.0.8010.",
  "ComponentUpdatesEnabled": true
}