CVE-2026-91738 Overview
CVE-2026-91738 is an improper input validation vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native graphics APIs. The flaw affects Google Chrome versions prior to 153.0.8010.47 and allows a remote attacker to potentially execute arbitrary code outside the browser sandbox through a crafted HTML page. Successful exploitation requires user interaction, such as visiting a malicious website. The weakness is classified under CWE-20: Improper Input Validation.
Critical Impact
A remote attacker can escape the Chrome renderer sandbox and execute arbitrary code on the host, resulting in full compromise of confidentiality, integrity, and availability.
Affected Products
- Google Chrome desktop versions prior to 153.0.8010.47
- Chromium-based browsers embedding vulnerable ANGLE builds
- Applications and frameworks bundling affected Chromium runtimes
Discovery Timeline
- 2026-09-15 - CVE-2026-91738 published to the National Vulnerability Database
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91738
Vulnerability Analysis
The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), which translates WebGL and OpenGL ES calls into Direct3D, Metal, or Vulkan operations on the host system. Improper validation of input passed to ANGLE allows an attacker to trigger conditions that bypass the renderer sandbox boundary. Because ANGLE operates with elevated graphics driver privileges compared to standard renderer code, a successful exploit escapes into a more privileged process context. The result is arbitrary code execution on the host operating system rather than execution confined to the sandboxed renderer.
Root Cause
The root cause is missing or insufficient input validation on parameters processed by ANGLE. When Chrome forwards graphics API commands originating from web content, ANGLE fails to fully verify structural or bounds constraints on attacker-controlled values. This validation gap permits state or memory to reach conditions the graphics layer was not designed to handle safely.
Attack Vector
Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The attack traverses the network with low complexity and no privileges, but does require user interaction. Because the sandbox escape crosses a security boundary, the scope is changed and impact extends beyond the browser process. Attackers can chain this issue with a renderer bug to achieve reliable end-to-end code execution.
No verified proof-of-concept code is publicly available. Technical details are tracked in the Chromium Issue Tracker Entry.
Detection Methods for CVE-2026-91738
Indicators of Compromise
- Unexpected child processes spawned from chrome.exe, Google Chrome Helper (GPU), or the GPU process on Linux.
- Outbound network connections initiated by Chrome-spawned processes to unfamiliar domains shortly after browsing activity.
- Creation of new persistence entries (registry Run keys, Launch Agents, cron jobs) originating from the Chrome process tree.
Detection Strategies
- Inventory installed Chrome versions across the environment and flag any build below 153.0.8010.47.
- Monitor GPU process behavior for anomalous file writes, memory allocations, or process spawns outside expected graphics operations.
- Correlate browser telemetry with EDR process lineage to identify sandbox escape patterns following visits to untrusted sites.
Monitoring Recommendations
- Enable browser telemetry forwarding to a central SIEM or data lake to retain process, network, and file events tied to Chrome.
- Alert on Chrome renderer or GPU processes writing to autostart locations or executing scripting interpreters such as powershell.exe, cmd.exe, or /bin/sh.
- Track DNS and HTTP telemetry for known malicious infrastructure serving crafted HTML exploit content.
How to Mitigate CVE-2026-91738
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.47 or later on all Windows, macOS, and Linux endpoints.
- Restart the browser after applying the update to ensure the patched ANGLE build is loaded.
- Audit Chromium-based browsers and embedded runtimes for downstream patches incorporating the ANGLE fix.
Patch Information
Google released the fix in the Chrome Stable channel. Refer to the Google Chrome Stable Update advisory for full version and rollout details. Enterprises using managed deployments should validate that automatic updates are enabled and that the patched version is reaching all clients.
Workarounds
- Restrict browsing to trusted sites via enterprise web filtering until patch deployment completes.
- Disable hardware acceleration in Chrome through the chrome://settings interface to reduce ANGLE code path exposure, accepting the associated performance impact.
- Deploy browser isolation or remote browser technology for high-risk users handling untrusted content.
# Verify installed Chrome version on Linux
google-chrome --version
# Force enterprise update via Chrome policy (Windows, Group Policy)
# Set: HKLM\Software\Policies\Google\Update\UpdateDefault = 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
