CVE-2026-91749

Published: Sep 15, 2026Updated: Sep 17, 2026 Sources: CVE List NVDCWE-416

9.6CRITICAL

NVD MITRE

Description

Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

In plain language

AI Act now

Google Chrome before 153.0.8010.47 has a serious flaw: a malicious webpage can break out of Chrome’s protections after someone opens it, so small businesses should update Chrome now.

Executive summary

Critical use-after-free in Chrome Web Workers enables potential sandbox escape and arbitrary code execution through crafted HTML after user interaction.

If affected, business impact

Device takeover riskBusiness data exposureRansomware riskWork disruption

What to do now

Check the Chrome version on company computers: open Chrome’s menu, choose Help, then About Google Chrome.
Update Google Chrome to 153.0.8010.47 or later, then restart the browser when prompted.
Ask staff to close unexpected webpages and report suspicious links until all work devices are updated.

Usually a quick update

What is it

This is a mistake in how Chrome handles a background part of a webpage. A malicious page could use it like slipping through a locked office’s back door, potentially getting past Chrome’s normal protective barrier and running unwanted code on the computer.

Who is affected

This matters to you if employees or business devices use Google Chrome. It is especially relevant for computers that open links, visit websites, or use web-based business tools; the attack requires someone to open a malicious webpage.

How urgent is it

An attacker can use a crafted webpage to try to run code beyond Chrome’s normal safety barrier after a user opens it. Treat this as urgent because the flaw is rated critical and has a straightforward web-delivery path, although there is no confirmed report of active attacks.

What to do — in detail

Confirm exposure by inventorying Chrome installations and checking their installed version through Chrome’s About page or your device-management tool. Upgrade all affected installations to Google Chrome 153.0.8010.47 or later; no branch-specific alternative fix is provided in the findings. The normal Chrome update path should apply, but test any managed browser policies or business web applications in a small group first if your organization controls updates centrally. If patching is delayed, reduce exposure by preventing use of Chrome on untrusted sites, restricting link-opening from email and chat where practical, and using an alternate approved browser only if it is current. CVE-2026-91749 is not listed in CISA KEV, so no CISA remediation due date is provided. Watch browser-management reports for devices that remain below the fixed version and investigate reports of unexpected downloads, browser crashes, or unfamiliar software launches after suspicious webpage visits.

Technical context

CVE-2026-91749 is CVSS 9.6 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). It is CWE-416, a use-after-free in Web Workers, reachable through a network-delivered crafted HTML page; no authentication is required, but user interaction is required. The reported capability is potential arbitrary code execution outside the Chrome sandbox. CISA KEV does not list the CVE, news provides no clear dated claim of exploitation in the wild, and no public exploit code is recorded. EPSS is 0.3% (27th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:RUser Interaction

Required

Scope

S:CScope

Changed

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-416

Affected Products

Google

commercial·USaka google llc, google inc

ChromeOn-premDesktop App

Consumer Software / browser

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Is your org exposed to CVE-2026-91749?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques

Initial Access

Privilege Escalation

View detailed technique mapping

References

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html

chromereleases.googleblog.com

https://issues.chromium.org/issues/558456602

issues.chromium.org

News mentions

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-91749 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows