CVE-2026-91711 in Chrome
Summary
by MITRE • 09/16/2026
Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as an out-of-bounds write within the ServiceWorker component of Google Chrome prior to version 153.0.8010.47 represents a critical memory corruption flaw that undermines the browser's sandboxing mechanisms. This specific type of error occurs when software writes data beyond the boundaries of allocated memory buffers, potentially overwriting adjacent memory structures or control flow metadata. In the context of Chrome’s architecture, ServiceWorkers operate in isolated contexts to manage background tasks and network requests, but they are still subject to strict security constraints designed to prevent malicious code from escaping their designated environment. The flaw allows a remote attacker who can trick a user into visiting a specially crafted HTML page to trigger this memory corruption during the execution of service worker scripts. By carefully crafting the input data sent to the vulnerable component, an attacker can manipulate the heap layout or overwrite critical pointers, thereby gaining the ability to execute arbitrary code within the sandboxed environment where the ServiceWorker is running.
From a technical perspective, out-of-bounds writes are particularly dangerous because they do not necessarily cause immediate application crashes, which often allows them to go undetected during initial exploitation phases. Instead, they provide an attacker with precise control over memory contents, enabling techniques such as heap spraying or arbitrary read-write primitives that can be chained together to bypass security mitigations like Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). The severity of this vulnerability is classified as High by the Chromium team because it directly facilitates code execution in a context that should remain isolated. This isolation is fundamental to modern web browser security models, ensuring that content from one origin cannot interfere with or access data from another. When an attacker achieves arbitrary code execution within the ServiceWorker sandbox, they effectively break this boundary, potentially leading to further privilege escalation if additional vulnerabilities are present or if the service worker has elevated permissions through specific APIs.
The operational impact of this vulnerability is significant for end-users and organizations relying on Chrome for secure web browsing. A successful exploit could allow an attacker to install malware, steal sensitive information such as cookies and session tokens stored in local storage, or perform actions on behalf of the user without their knowledge. Since ServiceWorkers often have access to network requests and caching mechanisms, compromising them can also facilitate man-in-the-middle attacks or content injection into web pages viewed by other users if the compromised service worker is shared across multiple contexts. This undermines the integrity of the browsing experience and poses a direct threat to data confidentiality and system availability. The ability to execute arbitrary code remotely means that no physical access or local user interaction beyond visiting a malicious webpage is required, making this a high-risk vector for drive-by download attacks and targeted phishing campaigns.
To mitigate the risks associated with this vulnerability, it is imperative to update Google Chrome to version 153.0.8010.47 or later immediately upon availability. This patch includes fixes that validate memory access boundaries within the ServiceWorker implementation, preventing the out-of-bounds write from occurring during script execution. Organizations should enforce automatic updates for all endpoints running Chrome to ensure consistent protection against known exploits. Additionally, implementing browser hardening policies such as restricting service worker registration permissions and disabling unnecessary features can reduce the attack surface. Security teams should also monitor for indicators of compromise related to unusual network activity or unexpected process behavior that might indicate exploitation attempts. Aligning with industry standards, this vulnerability maps to CWE-787: Out-of-bounds Write in the Common Weakness Enumeration database, which categorizes memory corruption flaws based on their potential for exploitation. Furthermore, from a tactical standpoint, attackers leveraging this flaw would likely align with MITRE ATT&CK technique T1059: Command and Scripting Interpreter or T1204: User Execution, depending on how the initial payload is delivered and executed within the compromised sandbox environment.