CVE-2026-91733 Overview
CVE-2026-91733 is an improper state validation vulnerability in the Skia graphics library used by Google Chrome versions prior to 153.0.8010.47. A remote attacker who has already compromised the renderer process can read memory outside the sandbox by serving a crafted HTML page. The flaw is classified under CWE-754: Improper Check for Unusual or Exceptional Conditions and is tracked internally by the Chromium team as issue 540021213. Google rates the Chromium security severity as High.
Critical Impact
Attackers chaining this bug with a prior renderer compromise can leak sensitive memory from outside the Chrome sandbox, undermining a core browser security boundary.
Affected Products
- Google Chrome for Desktop prior to 153.0.8010.47
- Chromium-based browsers embedding vulnerable Skia builds
- Downstream distributions shipping the pre-patch Skia component
Discovery Timeline
- 2026-09-15 - CVE-2026-91733 published to the National Vulnerability Database
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91733
Vulnerability Analysis
The vulnerability resides in Skia, the 2D graphics engine that Chrome uses to rasterize web content. Skia fails to properly validate an internal state before performing memory operations tied to graphics primitives rendered from attacker-controlled HTML. When the renderer processes a crafted page, the missing state check causes Skia to operate on memory it should not access.
Because exploitation requires the attacker to already control the renderer, this bug functions as a sandbox information disclosure primitive. It is typically chained with a separate renderer remote code execution flaw to escalate impact. The disclosed memory can include cross-origin data, pointer values useful for defeating Address Space Layout Randomization (ASLR), or fragments of session material stored in the browser process.
Root Cause
The root cause is an improper check for an exceptional condition inside Skia's rendering path. Without validating the expected state, Skia reads memory beyond the intended object boundary, producing an out-of-bounds read that crosses the renderer sandbox boundary. Chromium's issue 540021213 tracks the specific code paths corrected by the upstream fix.
Attack Vector
Exploitation requires network delivery of a crafted HTML page and user interaction to load it, combined with a prior compromise of the renderer process. A successful attack does not require authentication. The scope changes when the disclosure crosses the sandbox trust boundary, which is why the confidentiality, integrity, and availability impacts are elevated in the advisory. See the Google Chrome Stable Update for the vendor's description.
No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported for this issue at the time of publication.
Detection Methods for CVE-2026-91733
Indicators of Compromise
- Chrome renderer processes crashing with signals consistent with out-of-bounds reads in skia modules
- Unexpected outbound connections from Chrome to newly registered domains hosting graphics-heavy HTML payloads
- Browser telemetry showing execution of unfamiliar WebAssembly or WebGL content immediately before crash events
Detection Strategies
- Inventory Chrome installations across the fleet and flag any build older than 153.0.8010.47
- Alert on renderer sandbox escape indicators, including child process anomalies spawned by chrome.exe
- Correlate browser crash telemetry with proxy logs to identify pages that trigger repeat renderer faults
Monitoring Recommendations
- Ingest browser and endpoint telemetry into a centralized data lake to hunt for Skia-related crash patterns
- Monitor for post-exploitation behaviors such as credential access from browser process memory
- Track Chrome auto-update health so patched versions propagate within enterprise SLAs
How to Mitigate CVE-2026-91733
Immediate Actions Required
- Update Chrome to version 153.0.8010.47 or later on all managed endpoints
- Restart the browser after update to ensure the patched Skia library is loaded
- Validate Chromium-based third-party browsers for equivalent fixes from their vendors
Patch Information
Google addressed CVE-2026-91733 in the Chrome Stable channel at version 153.0.8010.47. Refer to the Google Chrome Stable Update advisory and the Chromium Issue Tracker #540021213 for release details.
Workarounds
- Enforce site isolation and restrict browsing to trusted domains for high-risk user groups
- Deploy web filtering to block newly observed domains serving untrusted graphics-heavy content
- Disable non-essential browser extensions that expand the renderer attack surface
# Verify Chrome version on Windows
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version
# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
# Verify Chrome version on Linux
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
