CVE-2026-91748: Google Chrome Race Condition Vulnerability

CVE-2026-91748 Overview

CVE-2026-91748 is a race condition vulnerability in the Extensions component of Google Chrome on macOS. The flaw affects Chrome versions prior to 153.0.8010.47 and is tracked under [CWE-367] (Time-of-Check Time-of-Use). A remote attacker who has already compromised the renderer process can leverage user interface interaction and social engineering to potentially execute arbitrary code outside the Chrome sandbox. Google rated the Chromium security severity as High.

Critical Impact
Successful exploitation allows an attacker to escape the Chrome renderer sandbox on macOS and execute arbitrary code in a higher-privileged process context.

Affected Products

Google Chrome on macOS prior to version 153.0.8010.47
Apple macOS (host operating system running affected Chrome builds)
Chromium-based browsers on macOS that share the vulnerable Extensions code path

Discovery Timeline

2026-09-15 - CVE-2026-91748 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in the NVD database

Technical Details for CVE-2026-91748

Vulnerability Analysis

The issue is a race condition [CWE-367] in Chrome's Extensions subsystem on macOS. Race conditions of this class occur when the state of a resource is checked, then acted upon, without atomic guarantees between the two operations. Between the check and the use, an attacker who controls a concurrent execution context can modify the underlying state.

Exploitation requires a compromised renderer process as a prerequisite. The attacker chains the renderer compromise with UI interaction driven by social engineering, causing the Extensions layer to act on stale or attacker-controlled state. The result is code execution outside the renderer sandbox on the macOS host.

The attack vector is network-based, but the high attack complexity and required user interaction reflect the multi-stage nature of the exploit chain. The scope change indicates that a successful attack breaks out of the sandbox boundary into a more privileged component.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) condition in the Extensions code path. Concurrent threads or IPC handlers operate on shared state without sufficient synchronization, allowing an attacker with renderer control to change the observed state between validation and consumption.

Attack Vector

The attack requires two preconditions. First, the attacker must compromise the renderer process, typically through a separate memory-safety or logic bug reachable from a malicious web page. Second, the attacker must induce the victim to perform a specific UI interaction with an extension surface, timed to win the race in the Extensions component. Public technical details are limited; see the Chromium Issue Tracker #521559611 for restricted implementation details.

No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation has been published for CVE-2026-91748. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-91748

Indicators of Compromise

Chrome renderer processes on macOS spawning unexpected child processes or writing to unusual filesystem locations outside the sandbox container.
Unexpected loading, enabling, or interaction with Chrome extensions immediately following a page navigation or prompt driven by an external site.
Chrome crash reports referencing Extensions IPC handlers or synchronization primitives on macOS builds prior to 153.0.8010.47.

Detection Strategies

Inventory installed Chrome versions across macOS endpoints and flag any build below 153.0.8010.47 as vulnerable.
Correlate renderer crash telemetry with subsequent process creation from Google Chrome Helper or extension host processes.
Monitor macOS Endpoint Security telemetry for Chrome-parented processes performing filesystem, keychain, or network access outside expected sandbox profiles.

Monitoring Recommendations

Ingest Chrome browser telemetry and macOS process events into a centralized data lake for cross-correlation of renderer compromise indicators and extension activity.
Alert on installation of unsigned or newly published extensions immediately preceding anomalous UI-driven interactions.
Track outbound connections from Chrome helper processes to newly registered or low-reputation domains during the vulnerability window.

How to Mitigate CVE-2026-91748

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 153.0.8010.47 or later.
Force-restart Chrome after deployment to ensure the patched binary is loaded across all user sessions.
Audit installed extensions and remove any that are unused, untrusted, or sideloaded outside the Chrome Web Store.

Patch Information

Google addressed CVE-2026-91748 in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Administrators should deploy Chrome 153.0.8010.47 or later on macOS. Restricted implementation details are tracked in Chromium Issue Tracker #521559611.

Workarounds

Enforce Chrome auto-update through macOS MDM policy to eliminate lagging installations.
Restrict extension installation to an allowlist managed via the ExtensionInstallAllowlist and ExtensionInstallBlocklist enterprise policies until patching completes.
Train users to reject unexpected UI prompts from web pages requesting extension interaction, reducing the social engineering surface required by this exploit chain.

bash

# Configuration example: enforce Chrome extension allowlist via macOS MDM
# Deploy this plist to /Library/Managed Preferences/com.google.Chrome.plist
defaults write com.google.Chrome ExtensionInstallBlocklist -array "*"
defaults write com.google.Chrome ExtensionInstallAllowlist -array \
  "<approved-extension-id-1>" \
  "<approved-extension-id-2>"

# Verify installed Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version