CVE-2026-91739: Google Chrome Authorization Bypass Vulnerability

CVE-2026-91739 Overview

CVE-2026-91739 is a missing authorization vulnerability in the Transactions Platform component of Google Chrome prior to version 153.0.8010.47. A remote attacker who has already compromised the renderer process can spoof user interface elements by delivering a crafted HTML page. The flaw is tracked under CWE-862: Missing Authorization and is rated Medium severity by the Chromium security team. Successful exploitation requires user interaction and depends on prior compromise of the renderer, which limits practical impact but enables convincing UI spoofing attacks against victims who interact with the crafted content.

Critical Impact
An attacker controlling the renderer process can spoof browser UI elements, enabling deception-based attacks against end users.

Affected Products

Google Chrome versions prior to 153.0.8010.47
Chromium-based browsers incorporating the vulnerable Transactions Platform component
Desktop Stable channel builds released before the September 2026 update

Discovery Timeline

2026-09-15 - CVE-2026-91739 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91739

Vulnerability Analysis

The defect resides in the Transactions Platform component of Google Chrome. This subsystem lacks an authorization check that would otherwise prevent untrusted content from influencing security-relevant UI elements. An attacker who has already achieved code execution inside a renderer process can craft an HTML page that triggers the missing check and manipulates on-screen elements presented to the user.

Because the flaw only unlocks UI spoofing rather than sandbox escape or memory corruption, its direct technical impact is bounded. However, spoofed UI elements are frequently used as the second stage of phishing or credential-theft chains, so the vulnerability is a useful primitive when paired with a separate renderer exploit.

Root Cause

The root cause is a missing authorization check ([CWE-862]) in the Transactions Platform. The component accepts state changes or rendering instructions that originate from a compromised renderer without verifying that the requesting context is entitled to alter those UI elements. Google Chrome 153.0.8010.47 introduces the missing check.

Attack Vector

Exploitation is remote over the network but requires two preconditions. First, the attacker must already control the renderer process, typically through a separate exploit chained with this bug. Second, the victim must interact with the crafted HTML page for the spoofed UI to influence their decisions. No specific proof-of-concept has been published, and no public exploit is currently available.

The vulnerability is described in prose only. See the Chromium Issue Tracker Entry and the Chrome Releases Update for vendor-authoritative technical detail.

Detection Methods for CVE-2026-91739

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.47 in enterprise inventory
Renderer processes exhibiting anomalous child-process behavior consistent with prior renderer compromise
User reports of unexpected transaction confirmation dialogs, payment prompts, or address-bar inconsistencies

Detection Strategies

Inventory browser versions across managed endpoints and flag any Chrome install below 153.0.8010.47
Correlate browser crash telemetry with subsequent process spawn events to identify renderer exploitation attempts
Monitor endpoint telemetry for HTML content delivery followed by unusual Chrome IPC activity

Monitoring Recommendations

Enable Chrome enterprise reporting to centralize version and extension telemetry
Forward browser process telemetry to a security data lake for retroactive hunting once new indicators are published
Track outbound network destinations for compromised users to identify follow-on credential exfiltration attempts

How to Mitigate CVE-2026-91739

Immediate Actions Required

Update all Google Chrome installations to version 153.0.8010.47 or later on Windows, macOS, and Linux
Restart Chrome after the update to ensure the patched binary is active on every endpoint
Verify managed Chromium-based browsers have absorbed the upstream fix

Patch Information

Google addressed CVE-2026-91739 in the Stable channel update documented in the Chrome Releases Update. Chrome 153.0.8010.47 and later contain the corrected authorization enforcement in the Transactions Platform component. Refer to the Chromium Issue Tracker Entry for additional context once the ticket is unrestricted.

Workarounds

Enforce automatic Chrome updates through enterprise policy to eliminate version drift
Restrict browsing to trusted sites and block high-risk categories at the web proxy while updates roll out
Educate users to verify transaction and payment prompts through independent channels until patching completes

bash

# Configuration example
# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version