CVE-2026-91743 Overview
CVE-2026-91743 is a race condition vulnerability in the Core component of Google Chrome prior to version 153.0.8010.47. An attacker who has already compromised the renderer process can exploit the flaw through a crafted HTML page to potentially execute arbitrary code outside the Chrome sandbox. Chromium engineers rated the security severity as High, and the issue is tracked as a Time-of-Check Time-of-Use weakness [CWE-367].
The vulnerability requires user interaction and a chained exploit path, but successful exploitation results in a sandbox escape that breaks Chrome's primary isolation boundary.
Critical Impact
Successful exploitation allows arbitrary code execution outside the Chrome sandbox, exposing the underlying operating system to attacker-controlled code.
Affected Products
- Google Chrome for Desktop prior to 153.0.8010.47
- Chromium-based browsers embedding the affected Core component
- Downstream Chromium forks that have not yet integrated the upstream fix
Discovery Timeline
- 2026-09-15 - CVE-2026-91743 published to the National Vulnerability Database
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91743
Vulnerability Analysis
The flaw is a race condition in Chrome's Core component. Two or more concurrent operations access a shared resource without proper synchronization. An attacker who already controls the renderer process can time operations to observe a state after a security check but before the resource is used, invalidating the check's assumptions.
Because Chrome relies on the renderer sandbox to contain hostile web content, escaping this boundary elevates a renderer compromise into host-level code execution. The vulnerability requires the attacker to first compromise the renderer through a separate bug, then chain this issue for the sandbox escape. User interaction is also required, typically visiting an attacker-controlled page.
Root Cause
The root cause is a Time-of-Check Time-of-Use (TOCTOU) condition classified under [CWE-367]. A privileged component in Chrome Core validates a resource or state, then acts on it in a later step. Between those steps, a concurrent thread controlled by the compromised renderer mutates the resource, so the trusted code operates on attacker-manipulated data.
Attack Vector
Exploitation follows a two-stage model. The attacker first compromises the renderer process, commonly through a memory corruption bug triggered by a crafted HTML or JavaScript payload. The attacker then races the vulnerable Core operation to trigger the TOCTOU condition and execute code outside the sandbox.
No verified public proof-of-concept is available. Full technical details are tracked in Chromium Issue Tracker #516947138.
Detection Methods for CVE-2026-91743
Indicators of Compromise
- Chrome renderer processes spawning unexpected child processes or writing to disk outside the profile directory
- Browser processes making outbound network connections to unfamiliar hosts shortly after loading untrusted content
- Crash reports referencing race conditions or synchronization faults in the Chrome Core component
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build older than 153.0.8010.47
- Monitor for anomalous process lineage where chrome.exe or its renderer children launch shells, scripting engines, or LOLBins
- Correlate browser crash telemetry with subsequent process creation events to identify possible sandbox escape attempts
Monitoring Recommendations
- Ingest endpoint process and browser telemetry into a centralized data lake for cross-host correlation
- Alert on Chrome writing executable content to user-writable directories such as %APPDATA% or /tmp
- Track Chrome update compliance as a continuous control rather than a point-in-time check
How to Mitigate CVE-2026-91743
Immediate Actions Required
- Update Chrome to version 153.0.8010.47 or later on all managed endpoints
- Force restart of running Chrome instances so the patched binary is loaded into memory
- Audit Chromium-derived browsers and embedded frameworks for downstream patch availability
Patch Information
Google addressed CVE-2026-91743 in the Chrome Stable channel release documented in the Google Chrome Desktop Update advisory. Administrators should confirm the deployed build is 153.0.8010.47 or newer and validate that automatic updates are functioning across the fleet.
Workarounds
- Restrict browsing to trusted sites via enterprise policy until patching completes
- Deploy site isolation and strict process-per-site policies to reduce renderer compromise reach
- Use application allowlisting to block unauthorized child processes spawned from the browser
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Windows: query the installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
