CVE-2026-91735: Google Chrome WebUI RCE Vulnerability

CVE-2026-91735 Overview

CVE-2026-91735 is an incorrect authorization vulnerability [CWE-863] in the WebUI component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.47. A remote attacker who has already compromised the renderer process can leverage the weakness to execute arbitrary code outside the Chrome sandbox using a crafted HTML page. Google's Chromium team rated the underlying security severity as High. Successful exploitation breaks a core browser security boundary and gives the attacker code execution at the browser process privilege level.

Critical Impact
Attackers with a compromised renderer can escape the Chrome sandbox and run arbitrary code on the host, bypassing a primary browser isolation control.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.47
Chromium-based browsers that inherit the vulnerable WebUI authorization logic
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-09-15 - CVE-2026-91735 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in the NVD database
September 2026 - Google published the fix in the Chrome Stable channel update for desktop

Technical Details for CVE-2026-91735

Vulnerability Analysis

The vulnerability resides in Chrome's WebUI subsystem, which powers privileged internal pages such as chrome:// URLs. WebUI pages run with elevated capabilities and expose Mojo IPC interfaces to backend browser components. An incorrect authorization check in this layer permits a compromised renderer to invoke privileged operations that should be restricted to trusted WebUI origins. Because the browser process trusts these requests, the attacker gains a path from a lower-privilege renderer to code execution in the higher-privilege browser context. The result is a sandbox escape, one of the highest-impact outcomes in browser security. Exploitation requires attacker complexity to chain a prior renderer compromise, which is reflected in the CVSS attack complexity rating.

Root Cause

The root cause is an authorization defect [CWE-863] in the WebUI request handling path. The affected code does not correctly verify that the caller is entitled to invoke certain privileged WebUI functionality. A malicious renderer can therefore issue requests that the browser process treats as originating from a trusted WebUI page. Google addressed the flaw in Chrome 153.0.8010.47 by tightening the authorization logic in the WebUI code paths.

Attack Vector

Exploitation is a two-stage attack. First, the attacker compromises the renderer process, typically by luring a user to a crafted HTML page that triggers a separate renderer vulnerability. Second, the compromised renderer sends malformed IPC or navigation requests that abuse the missing authorization check in the WebUI layer. This chain allows attacker-controlled code to execute outside the sandbox, giving access to the user's files, credentials, and network resources with the privileges of the browser process. Technical specifics are tracked in Chromium Issue #552416113.

Detection Methods for CVE-2026-91735

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as command shells, powershell.exe, or scripting interpreters
Anomalous file writes or persistence artifacts created under user profile paths by the Chrome parent process
Outbound network connections from Chrome to unusual command-and-control infrastructure following visits to untrusted HTML content
Crash telemetry referencing WebUI or Mojo interfaces on Chrome builds earlier than 153.0.8010.47

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any installation earlier than 153.0.8010.47
Monitor process lineage where chrome.exe (or platform equivalent) is the parent of non-browser executables
Correlate browser exploitation attempts with subsequent privilege changes, credential access, or lateral movement events
Ingest browser and endpoint telemetry into a centralized data lake for cross-signal correlation

Monitoring Recommendations

Enable behavioral endpoint detection to identify sandbox escape patterns such as unexpected code execution originating from browser processes
Track Chrome auto-update status and alert on hosts that fall behind the vendor-fixed build
Review web proxy and DNS logs for user visits to newly registered or low-reputation domains hosting HTML content

How to Mitigate CVE-2026-91735

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all managed endpoints
Verify that Chrome's automatic update mechanism is enabled and functioning across the fleet
Restart Chrome after updates to ensure the patched binaries are loaded into memory
Prioritize patching for high-value users such as administrators, developers, and executives

Patch Information

Google released the fix in the Chrome Stable channel update for desktop. Details are available in the Google Chrome Stable Update advisory. Administrators should confirm that all endpoints report a Chrome version of 153.0.8010.47 or higher.

Workarounds

No official workaround replaces the patch; upgrading Chrome is the only complete remediation
Restrict browsing to trusted sites using enterprise policy and web filtering to reduce exposure to hostile HTML content
Enforce site isolation and disable unnecessary browser extensions that could broaden the renderer attack surface
Deploy application allowlisting to block unexpected child processes spawned by the browser

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version