CVE-2026-91732: Google Chrome AppManifest Auth Bypass Flaw

CVE-2026-91732 Overview

CVE-2026-91732 is a missing authorization vulnerability [CWE-862] in the AppManifest component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.47. A remote attacker who has already compromised the renderer process can leverage social engineering to bypass Chrome's web origin policy through a crafted HTML page. Google classifies the Chromium security severity as Medium.

Critical Impact
Attackers who compromise the renderer process can bypass same-origin protections in Chrome's AppManifest handling, enabling cross-origin access that violates the browser's security boundary.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.47
Chromium-based browsers that inherit the vulnerable AppManifest implementation
Stable channel builds released before the September 2026 desktop update

Discovery Timeline

2026-09-15 - CVE-2026-91732 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91732

Vulnerability Analysis

The vulnerability resides in Chrome's AppManifest subsystem, which processes web application manifest files linked from HTML pages. The component fails to perform a required authorization check before honoring manifest-driven operations. When paired with a compromised renderer, this omission allows an attacker to escape the constraints of the web origin policy.

Exploitation is not fully remote in isolation. The attacker must first control the renderer process, typically via a separate memory corruption or logic bug. The attacker must also convince the user to interact with a crafted HTML page. Chained together, these preconditions permit access to resources or contexts that should remain isolated per origin.

Root Cause

The root cause is a missing authorization check [CWE-862] in the AppManifest handling logic. Chrome enforces the web origin policy to isolate content across sites. The AppManifest code path did not validate whether the requesting origin held the authority to perform the requested action, permitting cross-origin effects that the browser's security model prohibits.

Attack Vector

The attack requires two preconditions: renderer process compromise and successful social engineering of the target user. After the renderer is under attacker control, a crafted HTML page delivers a manifest reference that triggers the unauthorized code path. The result is a bypass of the web origin policy, undermining browser sandbox assumptions about cross-site isolation.

No public proof of concept is currently referenced in the advisory, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detailed technical information is tracked in the Chromium Issue Tracking #511062248 and the Google Chrome Stable Update announcement.

Detection Methods for CVE-2026-91732

Indicators of Compromise

Chrome processes on endpoints reporting a version string earlier than 153.0.8010.47 after the September 2026 stable update window.
Renderer process crashes or unexpected child process spawns preceding navigation to unfamiliar HTML pages.
Outbound requests to newly registered or low-reputation domains hosting web app manifest (.webmanifest) resources shortly after user interaction with a phishing lure.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.47.
Correlate browser telemetry with email and web gateway logs to identify social engineering delivery chains that precede renderer anomalies.
Alert on browser child process behavior that deviates from baseline, including unexpected file access or cross-origin resource requests.

Monitoring Recommendations

Ingest endpoint browser process telemetry into a centralized analytics platform and retain manifest fetch events for retrospective hunting.
Monitor DNS and HTTP telemetry for repeated requests to manifest.json or .webmanifest endpoints on suspicious domains.
Track patch compliance metrics for Chrome deployments and generate alerts for endpoints that miss the update window.

How to Mitigate CVE-2026-91732

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update to ensure the patched binaries are loaded into memory.
Audit enterprise browser management policies to confirm auto-update is enabled and not deferred.

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Administrators should validate that managed fleets have received the update through Chrome Browser Enterprise policies or their software distribution tooling. Chromium-derived browsers should be updated once downstream vendors integrate the fix.

Workarounds

Reinforce user awareness training focused on unsolicited links and crafted HTML content, since successful exploitation requires social engineering.
Restrict access to untrusted websites through web filtering or DNS security controls until patching completes.
Deploy application allowlisting or site isolation policies via Chrome enterprise configuration to reduce renderer exposure.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}" /v pv