CVE-2026-91746 Overview
CVE-2026-91746 is an integer overflow vulnerability [CWE-190] in the Compositing component of Google Chrome. The flaw affects versions prior to 153.0.8010.47 and allows a remote attacker to obtain cross-origin data through a crafted HTML page. Chromium project rates the security severity as High, while NVD assigns a medium base score reflecting limited confidentiality impact and required user interaction.
The vulnerability enables same-origin policy bypass, letting attackers read data from origins the victim's browser is authorized to access. Exploitation requires the victim to visit an attacker-controlled page.
Critical Impact
A remote attacker can craft an HTML page that triggers an integer overflow in the Compositing subsystem, exposing cross-origin data such as authenticated content rendered from other sites.
Affected Products
- Google Chrome versions prior to 153.0.8010.47 (Desktop Stable channel)
- Chromium-based browsers incorporating the vulnerable Compositing component
- All supported desktop platforms (Windows, macOS, Linux)
Discovery Timeline
- 2026-09-15 - CVE-2026-91746 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91746
Vulnerability Analysis
The defect resides in Chrome's Compositing pipeline, which combines layers of rendered content before display. An integer overflow occurs when the component performs arithmetic on attacker-influenced values, producing a wrapped result that bypasses subsequent bounds checks. The Chromium project classifies the security severity as High because the flaw crosses origin boundaries, a foundational browser security guarantee.
Cross-origin leaks in the compositor are notable because they can expose pixels or graphics buffers belonging to authenticated third-party sessions loaded in iframes or cross-origin resources. The attacker does not need credentials on the target origin — the victim's browser supplies them automatically.
Root Cause
The root cause is an unchecked arithmetic operation in the Compositing code path, categorized under [CWE-190] Integer Overflow or Wraparound. When operands exceed the storage width of the destination type, the value wraps around. Downstream logic then treats the wrapped value as valid, allowing memory or buffer regions belonging to other origins to be accessed during layer composition.
Attack Vector
Exploitation requires network access and user interaction: the victim must load a crafted HTML page. No privileges on the target system are needed. Once the page is loaded, the malicious script triggers the overflow condition and reads cross-origin data returned through the compositor. Refer to Chromium Issue Tracker #556260782 for the tracked defect record.
No public proof-of-concept or in-the-wild exploitation has been reported. The EPSS probability is 0.201%.
Detection Methods for CVE-2026-91746
Indicators of Compromise
- Chrome browser processes running versions earlier than 153.0.8010.47 observed in endpoint inventory data
- Outbound connections from browser processes to newly registered or low-reputation domains hosting HTML content that invokes heavy Canvas, WebGL, or compositor operations
- Unusual renderer process crashes or GPU process anomalies coinciding with visits to untrusted sites
Detection Strategies
- Query endpoint inventory for installed Chrome versions and flag hosts below 153.0.8010.47
- Correlate browser telemetry with proxy and DNS logs to identify users visiting suspicious pages containing exploit-like graphics workloads
- Monitor for renderer sandbox violations or GPU process termination patterns that may indicate exploitation attempts
Monitoring Recommendations
- Ingest browser version telemetry into your SIEM to track patch compliance over time
- Enable web proxy logging with URL categorization to detect access to malicious or uncategorized sites serving crafted HTML
- Alert on repeated Chrome crash events on the same host within a short window, which may indicate exploitation attempts
How to Mitigate CVE-2026-91746
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.47 or later on all managed endpoints
- Force-restart browser sessions after deployment so the patched binary is loaded into memory
- Verify Chromium-based third-party browsers in the environment have received the equivalent upstream fix
Patch Information
Google released the fix in the Stable channel update documented at the Google Chrome Stable Update announcement. Administrators managing Chrome through Google Admin Console, Group Policy, or MDM should confirm that automatic updates are enabled and that the target version has propagated to all users.
Workarounds
- Restrict browsing to trusted sites via web proxy allow-lists until patching is complete
- Advise users to avoid clicking links from untrusted sources and to close the browser between sensitive sessions
- Use enterprise policies to disable or reduce exposure of hardware-accelerated compositing features on unpatched systems if operationally acceptable
# Verify installed Chrome version on Windows endpoints via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
# Force Chrome update check on macOS/Linux
google-chrome --product-version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
