CVE-2026-91744: Google Chrome Race Condition Vulnerability

CVE-2026-91744 Overview

CVE-2026-91744 is a race condition vulnerability in the PlatformIntegration component of Google Chrome on macOS. The flaw affects Chrome versions prior to 153.0.8010.47 running on Apple macOS. A remote attacker who has already compromised the renderer process can exploit the race condition through a crafted HTML page and social engineering to obtain sensitive information. Chromium classifies the internal security severity as High, while the assigned CVSS 3.1 score of 5.3 reflects the high attack complexity and required user interaction. The weakness is tracked under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition.

Critical Impact
Successful exploitation allows an attacker with an already-compromised renderer to read sensitive information from the browser process on macOS.

Affected Products

Google Chrome for macOS versions prior to 153.0.8010.47
Apple macOS (all supported versions running vulnerable Chrome builds)
Chromium-based browsers on macOS sharing the PlatformIntegration code path

Discovery Timeline

2026-09-15 - CVE-2026-91744 published to NVD
2026-09-17 - Last updated in NVD database
2026-09 - Google releases Stable Channel Update for Desktop containing the fix (Google Chrome Stable Update)

Technical Details for CVE-2026-91744

Vulnerability Analysis

The vulnerability resides in the PlatformIntegration component of Chrome on macOS. PlatformIntegration handles interactions between the Chromium browser process and native macOS platform services. A race condition arises when two concurrent execution paths access shared state without proper synchronization, producing a time-of-check to time-of-use (TOCTOU) window an attacker can influence.

Exploitation requires two preconditions. First, the attacker must have already compromised the renderer process, typically through a separate memory corruption or logic bug. Second, the attacker must trick the user into interacting with a crafted HTML page. When both conditions align, the race window can be leveraged to disclose sensitive information that should remain isolated from the renderer sandbox. The Chromium project rated this issue High internally, while the public CVSS score reflects the high complexity of winning the race and the user interaction requirement.

Root Cause

The root cause is a classic TOCTOU condition [CWE-367] in PlatformIntegration where the state of a resource is validated at one point in time and then acted upon later without a lock or atomic operation guaranteeing the state has not changed. On macOS, thread scheduling and interprocess message ordering create windows where a compromised renderer can influence values consumed by the browser process.

Attack Vector

The attack vector is network-based and requires user interaction. A remote attacker hosts a crafted HTML page and uses social engineering to convince the target to visit it. The page delivers a payload that first exploits an unrelated renderer flaw to gain code execution inside the sandboxed renderer. From there, the attacker times messages to the browser process to hit the race window in PlatformIntegration and extract sensitive data across the sandbox boundary. Refer to the Chromium Issue Tracker Entry for additional technical context.

Detection Methods for CVE-2026-91744

Indicators of Compromise

Chrome browser processes on macOS spawning unexpected child processes or exhibiting abnormal IPC message patterns following visits to untrusted sites.
Users reporting redirects or lures pushing them to install extensions, click prompts, or approve dialogs on unfamiliar domains.
Endpoint telemetry showing Chrome renderer processes reading or exfiltrating data from unexpected memory regions or file paths.

Detection Strategies

Inventory installed Chrome versions across macOS fleets and flag any build below 153.0.8010.47.
Correlate browser telemetry with web proxy logs to identify sessions where users landed on suspicious pages immediately before anomalous Chrome activity.
Monitor for known renderer exploit precursors, since this issue requires a prior renderer compromise to be useful to an attacker.

Monitoring Recommendations

Enable and centralize Chrome Enterprise reporting to collect version, extension, and crash data from managed macOS endpoints.
Alert on Chrome crash signatures involving PlatformIntegration or repeated renderer crashes on the same host.
Track outbound connections from Chrome processes to newly registered or low-reputation domains delivering HTML payloads.

How to Mitigate CVE-2026-91744

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 153.0.8010.47 or later using the Stable Channel build.
Restart Chrome after the update so the patched binaries are loaded across all browser and renderer processes.
Verify deployment by auditing chrome://version or using MDM inventory queries against the managed macOS fleet.

Patch Information

Google addressed CVE-2026-91744 in the Stable Channel update for desktop that ships Chrome 153.0.8010.47 for macOS. Details of the release are available in the Google Chrome Stable Update announcement, and the underlying issue is tracked in the Chromium Issue Tracker Entry.

Workarounds

Enforce site isolation and Safe Browsing Enhanced Protection through Chrome Enterprise policy to reduce the likelihood of a successful initial renderer compromise.
Restrict browsing to trusted sites via web filtering while patch deployment is in progress, since exploitation requires the user to visit an attacker-controlled page.
Deliver targeted user awareness communications about the social engineering component required to reach the vulnerable code path.

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force a Chrome update check via the built-in updater
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot -userInitiated YES