CVE-2026-91736 Overview
CVE-2026-91736 is a use-after-free vulnerability in the Document Object Model (DOM) implementation of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.47. A remote attacker can execute arbitrary code inside the Chrome renderer sandbox by luring a user to a crafted HTML page. Google classifies the Chromium security severity as High. The weakness is tracked under CWE-416: Use After Free.
Critical Impact
Successful exploitation grants arbitrary code execution within the Chrome renderer sandbox, giving attackers a foothold for further sandbox escape chains and browser-based compromise.
Affected Products
- Google Chrome for Desktop prior to 153.0.8010.47
- Chromium-based browsers that share the vulnerable DOM code path
- Embedded applications relying on affected Chromium builds
Discovery Timeline
- 2026-09-15 - CVE-2026-91736 published to the National Vulnerability Database
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91736
Vulnerability Analysis
The vulnerability resides in Chrome's DOM subsystem, which manages the in-memory representation of HTML documents. A use-after-free condition occurs when the browser continues to reference a DOM object after its backing memory has been freed. An attacker who controls the timing of object destruction can reclaim that memory with attacker-influenced data. Subsequent access to the dangling pointer leads to controlled memory corruption. Chrome's renderer process then executes code paths that operate on the reclaimed object, enabling arbitrary code execution inside the sandbox.
Root Cause
The root cause is improper object lifetime management in the DOM, categorized as [CWE-416]. Specific object references remain valid to the renderer after their underlying allocation has been released. Complex DOM mutations, script callbacks, and event handling create the window in which references outlive their allocations.
Attack Vector
Exploitation requires a remote attacker to host a crafted HTML page and convince a user to load it. No credentials are required, but the victim must interact with the malicious content, typically by visiting a link. The payload manipulates DOM structures to trigger the freed-object access. Once memory corruption is achieved, the attacker gains code execution constrained by the renderer sandbox. See the Chromium Issue Tracker #553121008 for technical details.
Detection Methods for CVE-2026-91736
Indicators of Compromise
- Chrome renderer processes crashing repeatedly on specific web pages, indicated by SIGSEGV or EXCEPTION_ACCESS_VIOLATION events
- Outbound connections from Chrome to newly registered or low-reputation domains preceding renderer crashes
- Child processes spawned by chrome.exe that do not match expected renderer or utility patterns
Detection Strategies
- Inventory Chrome installations across the fleet and flag any build below 153.0.8010.47
- Correlate browser crash telemetry with URL and referrer data to identify potential exploitation attempts
- Monitor for post-exploitation behaviors such as script interpreters, LOLBins, or persistence primitives launched by browser processes
Monitoring Recommendations
- Ingest Chrome crash reports and Windows Error Reporting or macOS ReportCrash events into your SIEM for correlation
- Alert on process ancestry violations where Chrome renderer processes spawn shells, rundll32, powershell, or wscript
- Track Chrome version compliance continuously and generate exceptions for endpoints running vulnerable builds
How to Mitigate CVE-2026-91736
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.47 or later on all Windows, macOS, and Linux endpoints
- Restart Chrome after the update to ensure the patched binaries are loaded into memory
- Verify managed Chromium-based browsers have absorbed the upstream fix and push equivalent updates
Patch Information
Google addressed the flaw in the Chrome Stable Channel release announced in the Google Chrome Desktop Update. Administrators managing Chrome via enterprise policy should confirm that the TargetVersionPrefix and update servers permit clients to reach 153.0.8010.47 or newer.
Workarounds
- Restrict browsing to trusted domains through web filtering or DNS controls until patches are deployed
- Enable Chrome's Site Isolation and Enhanced Safe Browsing to raise the cost of exploitation
- Deploy application allowlisting to block unauthorized child processes spawned from chrome.exe
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
