CVE-2026-91745: Google Chrome V8 Use After Free Vulnerability

CVE-2026-91745 Overview

CVE-2026-91745 is a use-after-free vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.47. A remote attacker can exploit the vulnerability by serving a crafted HTML page to a target user. Successful exploitation allows arbitrary code execution inside the Chrome renderer sandbox. Google's Chromium project rates the security severity as High.

The vulnerability is tracked under CWE-416: Use After Free and was addressed in the Chrome Stable channel update published by Google.

Critical Impact
Attackers can execute arbitrary code within the Chrome renderer process by luring a victim to a malicious web page, providing a foothold that can be chained with sandbox escapes for full system compromise.

Affected Products

Google Chrome versions prior to 153.0.8010.47 on Desktop
Chromium-based browsers embedding vulnerable V8 builds
Downstream distributions bundling the affected Chrome release

Discovery Timeline

2026-09-15 - CVE-2026-91745 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91745

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. A use-after-free condition occurs when the engine continues to reference memory that has already been released. An attacker who controls the timing of object allocations and deallocations from JavaScript can reclaim the freed memory with attacker-shaped data.

Once the stale pointer is dereferenced, the engine operates on attacker-controlled contents. This primitive is commonly escalated into type confusion, arbitrary read/write, and finally shellcode execution within the renderer process. Exploitation is constrained by Chrome's sandbox, but renderer code execution provides a reliable stepping stone for further exploitation, particularly when paired with a sandbox-escape bug.

Detailed root-cause information is tracked in Chromium Issue Tracker #558734727 and the Google Chrome Stable Update advisory.

Root Cause

The root cause is improper object lifetime management inside V8 [CWE-416]. A code path frees an object while another reference remains reachable. Subsequent operations dereference that dangling reference, allowing attacker-controlled memory to be interpreted as a live V8 object.

Attack Vector

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build. The attack is network-reachable and requires user interaction, which is typically achieved through malvertising, phishing links, or watering-hole compromises. No authentication is required to deliver the exploit.

No public proof-of-concept exploit is currently listed for CVE-2026-91745, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. Historically, V8 use-after-free bugs have been reproduced quickly once patch diffing is possible.

Detection Methods for CVE-2026-91745

Indicators of Compromise

Chrome renderer processes crashing with access-violation or heap-corruption signatures shortly after visiting an untrusted URL.
Unexpected child processes spawned by chrome.exe following browsing sessions to low-reputation domains.
Outbound connections from Chrome renderer processes to attacker infrastructure delivering second-stage payloads.
Chrome versions below 153.0.8010.47 reported in endpoint inventory telemetry.

Detection Strategies

Inventory installed browser versions across the estate and flag any Chrome build older than 153.0.8010.47.
Alert on browser processes writing executable content or loading unsigned modules into memory.
Monitor for anomalous script execution and process injection originating from Chrome renderer processes.
Correlate web-proxy logs with endpoint telemetry to identify users who visited exploit-hosting URLs prior to suspicious activity.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake to enable retrospective hunts against newly published indicators.
Track Chromium security release notes and correlate patched CVEs against installed versions in configuration management data.
Enable crash reporting from Chrome to security operations to surface exploit attempts that fail before achieving code execution.

How to Mitigate CVE-2026-91745

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update completes, since the patch is only applied to new browser processes.
Push the update through enterprise management tooling and verify installation on managed endpoints.
Prioritize patching for users with broad internet access and administrative privileges.

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should be updated once their vendors release builds incorporating the patched V8 branch.

Workarounds

Restrict browsing to trusted domains via web-proxy or DNS filtering until patching completes.
Deploy Chrome enterprise policies that disable JIT compilation in V8 to reduce the exploitability of memory-corruption bugs.
Enforce site isolation and use separate browser profiles for high-risk activities.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version from the registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Enterprise policy example: disable V8 JIT to reduce attack surface
# Windows registry path:
# HKLM\Software\Policies\Google\Chrome\DefaultJavaScriptJitSetting = 2