CVE-2026-91747 Overview
CVE-2026-91747 is a use-after-free vulnerability [CWE-416] in the Skia graphics library used by Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.47. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to read cross-origin data. Google's Chromium team rated the security severity as High, while the NVD CVSS 3.1 base score is 3.1 (Low) reflecting the prerequisite of a compromised renderer and required user interaction.
Critical Impact
An attacker with control of a Chrome renderer process can bypass the same-origin policy through Skia and exfiltrate data from other origins rendered in the browser.
Affected Products
- Google Chrome versions prior to 153.0.8010.47
- Chromium-based builds embedding vulnerable Skia versions
- Desktop Stable channel distributions of Google Chrome
Discovery Timeline
- 2026-09-15 - CVE-2026-91747 published to the National Vulnerability Database
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91747
Vulnerability Analysis
The vulnerability resides in Skia, the 2D graphics rendering library used by Chromium for canvas, image, and compositor operations. A use-after-free condition occurs when Skia continues to reference a graphics object after its underlying memory has been released. An attacker who already controls the renderer process can drive Skia into this state through a crafted HTML page and manipulate the freed allocation.
The direct impact is disclosure of cross-origin data. Because Skia operates on pixel and image buffers that may include content from other origins, dangling references can expose data that the same-origin policy would otherwise protect. Integrity and availability are not affected, and the attacker cannot gain code execution through this flaw alone.
Exploitation requires the attacker to have compromised the renderer beforehand, typically by chaining this bug with a separate renderer-level vulnerability. It also requires user interaction, such as visiting an attacker-controlled or malicious page.
Root Cause
The root cause is improper lifetime management of a Skia object referenced across rendering operations. When the object is freed, a stale pointer remains reachable, and subsequent operations dereference memory that may now hold cross-origin pixel or texture data.
Attack Vector
The attack vector is network-based through a malicious HTML page. The adversary must first hold a compromised renderer process, then trigger the Skia code path that reuses the freed object to read data outside the current origin's boundary.
No public proof-of-concept code is available for this issue. Technical details are tracked in the Chromium Issue Tracker entry 540016074.
Detection Methods for CVE-2026-91747
Indicators of Compromise
- Chrome browser processes running versions earlier than 153.0.8010.47 on managed endpoints
- Renderer process crashes referencing Skia modules such as skia.dll or libskia in crash telemetry
- Unexpected child process spawns or outbound network activity from chrome.exe following visits to untrusted pages
Detection Strategies
- Inventory installed Chrome versions across endpoints and flag builds below 153.0.8010.47
- Correlate renderer crash reports with browsing history to identify pages triggering Skia faults
- Monitor for renderer sandbox escape indicators, since this bug is most useful as part of an exploit chain
Monitoring Recommendations
- Ingest browser process telemetry and crash logs into a centralized logging platform for version and stability analysis
- Alert on Chrome instances that fail to update within the vendor's release cadence
- Track outbound connections initiated by renderer processes to detect potential data exfiltration attempts
How to Mitigate CVE-2026-91747
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.47 or later on all endpoints
- Verify enterprise update policies deliver the Stable channel patch without user deferral
- Restart browser sessions after patch deployment to ensure the fixed Skia code is loaded
Patch Information
Google addressed this issue in the Stable channel update announced in the Google Chrome Release Update. Chrome versions 153.0.8010.47 and later contain the corrected Skia object lifetime handling.
Workarounds
- Restrict browsing to trusted sites through enterprise policy until patches are applied
- Enforce site isolation and strict cross-origin controls via Chrome enterprise settings
- Deploy browser update enforcement policies to prevent users from running outdated builds
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Verify installed Chrome version on Linux
google-chrome --version
# Force update check via enterprise policy (Windows)
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
