CVE-2026-91734: Google Chrome RCE Vulnerability

CVE-2026-91734 Overview

CVE-2026-91734 is an incorrect authorization vulnerability [CWE-863] in the Core component of Google Chrome on Windows. The flaw affects Chrome versions prior to 153.0.8010.47. A local attacker can leverage a local program to execute arbitrary code outside the Chrome sandbox. Google's Chromium security team rates the severity as High.

The vulnerability requires local access and does not need authentication or user interaction. Successful exploitation breaks the Chrome sandbox boundary on Windows hosts, giving attackers execution capability at the browser process level.

Critical Impact
Sandbox escape on Windows endpoints enables arbitrary code execution outside Chrome's security boundary, bypassing a core browser defense against untrusted web content.

Affected Products

Google Chrome for Windows prior to 153.0.8010.47
Microsoft Windows (host operating system)
Chromium-based deployments sharing the vulnerable Core component

Discovery Timeline

2026-09-15 - CVE-2026-91734 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91734

Vulnerability Analysis

The defect resides in Chrome's Core component and is classified under CWE-863: Incorrect Authorization. An authorization check does not correctly validate the caller before granting access to a privileged operation. A local program running on the same Windows host can invoke the mispermitted path and reach functionality that should remain isolated inside the sandbox.

Chrome's Windows sandbox restricts renderer and helper processes to a minimal set of operations. When authorization logic fails inside a boundary-crossing component, an attacker escapes those restrictions and gains the ability to run code with the privileges of the affected browser process.

Root Cause

The root cause is missing or incorrect authorization enforcement in the Core component. The check permits a locally initiated caller to invoke functionality reserved for trusted callers. Because the flaw sits at an authorization boundary rather than in memory-management code, the bug does not require corrupting memory to succeed.

Attack Vector

Exploitation requires local access to the Windows host. A malicious or compromised local program interacts with the affected Chrome interface and abuses the flawed authorization check to execute code outside the sandbox. No privileges and no user interaction are required, but attack complexity is high, indicating specific runtime conditions must be met. See the Chromium Issue Tracker entry #516780835 and the Google Chrome Stable Update advisory for vendor detail.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-91734

Indicators of Compromise

Chrome browser processes (chrome.exe) spawning unexpected child processes on Windows endpoints.
Local processes with no legitimate browser integration issuing inter-process calls to Chrome components.
Chrome versions on Windows reporting a build below 153.0.8010.47 in enterprise inventory.

Detection Strategies

Inventory Chrome installations across Windows fleets and flag hosts running versions prior to 153.0.8010.47.
Hunt for anomalous parent-child process relationships originating from Chrome, particularly executions of shells or scripting engines.
Correlate local process launches with Chrome activity to identify programs interacting with browser IPC surfaces.

Monitoring Recommendations

Ingest endpoint process telemetry into a centralized data lake and alert on Chrome sandbox anomalies.
Monitor Windows event logs and EDR telemetry for privilege transitions initiated from browser processes.
Track patch compliance for Chrome and Chromium-based browsers as a recurring metric.

How to Mitigate CVE-2026-91734

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 153.0.8010.47 or later.
Force-restart Chrome after deployment to ensure the patched binaries are loaded into memory.
Audit third-party Chromium-based browsers for equivalent fixes tied to the Core component.

Patch Information

Google addressed the flaw in Chrome Stable 153.0.8010.47 for Windows. Deployment details are published in the Google Chrome Stable Channel Update. Enterprises using Chrome Browser Cloud Management or Group Policy should push the update through their existing channels and verify version reporting after rollout.

Workarounds

Restrict which local programs can run on sensitive Windows hosts using application control policies such as Windows Defender Application Control or AppLocker.
Limit interactive logon rights on high-value endpoints to reduce the pool of accounts that can execute a local exploit program.
Where patching is delayed, isolate affected hosts from untrusted user workloads until the update is applied.

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Expected output must be 153.0.8010.47 or higher