CVE-2026-91741: Google Chrome CacheStorage RCE Vulnerability

CVE-2026-91741 Overview

CVE-2026-91741 is a type confusion vulnerability in the CacheStorage component of Google Chrome. The flaw affects versions prior to 153.0.8010.47 and allows a remote attacker to execute arbitrary code inside the Chrome renderer sandbox through a crafted HTML page. Google classified the Chromium security severity as High. The vulnerability is tracked under CWE-843: Access of Resource Using Incompatible Type.

Successful exploitation requires user interaction, specifically visiting a malicious web page. Code execution is confined to the sandboxed renderer process, so full system compromise requires chaining an additional sandbox escape.

Critical Impact
A crafted web page can trigger arbitrary code execution within the Chrome renderer sandbox, enabling browser-based attacks against any user who visits attacker-controlled or compromised sites.

Affected Products

Google Chrome versions prior to 153.0.8010.47 (Desktop Stable channel)
Chromium-based browsers that embed the vulnerable CacheStorage implementation
All operating systems supported by the Chrome Desktop Stable channel

Discovery Timeline

2026-09-15 - CVE-2026-91741 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91741

Vulnerability Analysis

The vulnerability resides in Chrome's CacheStorage implementation, part of the Service Worker and Fetch API surface exposed to web content. CacheStorage allows web pages to store and retrieve Request and Response objects for offline use. A type confusion condition in this component means an object of one type is accessed as if it were another type. This mismatch lets an attacker manipulate memory layout assumptions the renderer relies on.

Because CacheStorage is reachable from any origin through standard web APIs, an attacker only needs the victim to load an HTML page that issues crafted cache operations. Exploitation yields arbitrary code execution inside the renderer sandbox. Additional vulnerabilities are required to break out of the sandbox and impact the host system.

Root Cause

Type confusion vulnerabilities [CWE-843] arise when code casts or interprets an object as a type incompatible with its actual layout. In the Chrome renderer, this typically involves C++ object pointers where a base class or union member is treated as a derived type. Reading or writing through the incorrect type can corrupt adjacent memory, leak pointers, or invoke unintended virtual functions. Public technical details are limited pending broader patch adoption. See Chromium Issue #546413288 for the upstream tracking record.

Attack Vector

The attack is delivered over the network through a crafted HTML page. A victim must visit the page or load it inside an embedded frame such as an advertisement or iframe. No credentials are required. Once the page executes JavaScript that interacts with CacheStorage, the type confusion can be triggered to gain code execution in the renderer process. Chrome's multi-process architecture limits initial impact to the renderer, but attackers commonly chain such bugs with sandbox escapes for full compromise.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-91741

Indicators of Compromise

Chrome renderer process crashes referencing CacheStorage, ServiceWorker, or blink::CacheStorage in crash dumps
Unexpected child processes spawned by chrome.exe following a browsing session
Outbound connections from renderer processes to newly registered or low-reputation domains hosting Service Worker scripts

Detection Strategies

Inventory browser versions across the fleet and flag any Chrome installation below 153.0.8010.47
Monitor endpoint telemetry for anomalous process behavior originating from chrome.exe, including unusual memory allocations or code execution outside the sandbox
Correlate web proxy logs with browser crash events to identify pages that consistently precede renderer failures

Monitoring Recommendations

Enable browser crash reporting and forward events to a centralized log platform for review
Alert on Chrome versions that fall behind vendor releases beyond an approved patch window
Track Service Worker registrations from unusual origins in enterprise browsing telemetry

How to Mitigate CVE-2026-91741

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all managed endpoints
Restart Chrome after updates to ensure the patched binaries are loaded into active sessions
Audit Chromium-based browsers such as Microsoft Edge, Brave, and Opera and apply vendor updates that incorporate the upstream fix

Patch Information

Google released the fix in the Chrome Stable channel update announced on the Google Chrome Stable Update blog. Administrators should deploy version 153.0.8010.47 or newer across Windows, macOS, and Linux. Enterprise environments using group policy can enforce the minimum version through Chrome's TargetVersionPrefix policy. Upstream tracking is available at Chromium Issue #546413288.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patches are deployed
Disable Service Worker functionality on high-risk endpoints using the ServiceWorkerAllowedForUrls and related enterprise policies
Use site isolation and enforce SitePerProcess policy to reduce cross-origin exposure from a compromised renderer

bash

# Enforce minimum Chrome version via enterprise policy (Windows registry example)
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "153.0.8010.47" /f

# Verify installed Chrome version on Linux
google-chrome --version

# macOS version check
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version