CVE-2026-91749: Google Chrome Workers Use After Free Flaw

CVE-2026-91749 Overview

CVE-2026-91749 is a use-after-free vulnerability in the Workers component of Google Chrome prior to version 153.0.8010.47. A remote attacker can exploit this flaw by serving a crafted HTML page that triggers memory corruption in the Workers implementation. Successful exploitation allows arbitrary code execution outside the Chrome sandbox, giving the attacker code execution in the context of the browser process. Google's Chromium team rated the underlying issue as Critical severity. The vulnerability is tracked under CWE-416: Use After Free and requires user interaction, such as visiting a malicious website.

Critical Impact
Remote attackers can achieve arbitrary code execution outside the Chrome sandbox through a single crafted HTML page.

Affected Products

Google Chrome versions prior to 153.0.8010.47
Chromium-based browsers using the vulnerable Workers implementation
Desktop distributions across Windows, macOS, and Linux stable channels

Discovery Timeline

2026-09-15 - CVE-2026-91749 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91749

Vulnerability Analysis

The vulnerability resides in the Workers subsystem, which handles background script execution isolated from the main browser thread. A use-after-free condition occurs when the Workers code accesses memory that has already been released. Attackers can groom the freed memory region with attacker-controlled data before the dangling reference is dereferenced. This primitive enables control over program flow and, when chained with sandbox escape mechanics inherent to the flaw, leads to code execution outside the renderer sandbox.

Exploitation requires the victim to load a crafted HTML page. No authentication is required, and the attack traverses the network. The scope change indicated by the CVSS vector reflects that compromise of the renderer can affect the browser process and, by extension, the host operating system context of the user.

Root Cause

The root cause is improper lifetime management of an object within Chrome's Workers implementation. A reference to an object persists after the object is freed, and subsequent operations dereference that stale pointer. See the upstream Chromium Issue #558456602 tracking record for engineering details.

Attack Vector

An attacker hosts a malicious page or injects malicious content into a page the target visits. When the browser parses and executes the crafted markup and associated Worker scripts, the flaw triggers. Because the bug allows execution outside the sandbox, exploitation bypasses the renderer isolation boundary that normally contains web-borne code execution. Malvertising, watering-hole compromises, and phishing links are viable delivery channels.

No verified public proof-of-concept code was available at the time of publication. Refer to the Google Chrome Stable Update advisory for release notes.

Detection Methods for CVE-2026-91749

Indicators of Compromise

Chrome renderer or browser process crashes with heap corruption signatures shortly after visiting untrusted pages
Unexpected child processes spawned by chrome.exe or the Chrome helper process following web browsing activity
Outbound network connections from browser-spawned processes to previously unseen infrastructure
Endpoint telemetry showing browser processes writing executables or scripts to disk

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds earlier than 153.0.8010.47
Correlate browser process crash events with subsequent process creation or persistence activity
Hunt for anomalous behavior chains originating from Chrome renderer or utility processes
Ingest browser and endpoint telemetry into a centralized data lake for cross-source correlation

Monitoring Recommendations

Monitor endpoint EDR telemetry for post-exploitation behaviors following browser activity, including credential access and lateral movement
Track web proxy and DNS logs for connections to newly registered or low-reputation domains delivered to end users
Alert on Chrome auto-update failures that leave endpoints on vulnerable builds
Review browser extension inventories, as compromised browser processes can abuse extension permissions

How to Mitigate CVE-2026-91749

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all managed endpoints immediately
Force browser restarts to ensure the patched binary is loaded, since Chrome only applies updates after relaunch
Verify Chromium-derived browsers in the environment have also incorporated the upstream fix
Prioritize patching for users with elevated privileges or access to sensitive systems

Patch Information

Google released the fix in the Chrome Stable channel at version 153.0.8010.47. Deployment details are published in the Google Chrome Stable Update advisory. Organizations managing Chrome via enterprise policy should confirm the update ring has rolled forward to the fixed build.

Workarounds

Restrict browsing to trusted sites through web filtering or isolated browsing environments until patching completes
Disable or restrict Workers-heavy web applications from untrusted origins where feasible via enterprise policy
Deploy remote browser isolation for high-risk users who cannot be patched immediately
Enforce site-per-process and strict Site Isolation policies through Chrome enterprise configuration

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: check installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enterprise policy: enforce automatic updates (Chrome Enterprise)
# Set UpdateDefault=1 and AutoUpdateCheckPeriodMinutes to a low value