CVE-2026-91712 in Chrome
Summary
by MITRE • 09/16/2026
Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Google Chrome on macOS prior to version 153.0.8010.47 represents a critical race condition within the Extensions subsystem, classified under CWE-362 as a Concurrency Error involving Incorrect Race Condition. This flaw specifically impacts the security model of the browser by allowing an attacker who has already achieved code execution within a renderer process to escalate privileges and escape the sandbox environment. The root cause lies in improper synchronization mechanisms when handling extension-related operations, where multiple threads or processes may access shared resources without adequate locking or atomicity guarantees.
In typical web browsing scenarios, Chrome employs a multi-process architecture designed to isolate untrusted content from sensitive system components through sandboxes. Renderer processes are heavily restricted and operate with limited permissions to prevent malicious websites from directly accessing the host operating system. However, this race condition exploits timing windows in how extensions interact with these renderer processes. An attacker can craft a specific HTML page that triggers concurrent operations within the extension APIs or internal browser structures. By carefully manipulating the execution flow through precise timing attacks, the adversary can cause the browser to perform actions outside the intended security boundaries before synchronization checks are completed.
The operational impact of this vulnerability is severe because it effectively neutralizes one of Chrome's primary defense-in-depth mechanisms: process isolation. Once an attacker successfully exploits this race condition, they gain the ability to execute arbitrary code with higher privileges than those granted to a standard renderer process. This escape from the sandbox allows for potential access to user data, installation of persistent malware, or further lateral movement within the affected system. The Chromium security team has rated this issue as High severity due to its direct implication on the integrity and confidentiality of user systems when interacting with malicious web content that leverages extension functionalities.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.47 or later, where these synchronization issues have been addressed through improved locking mechanisms and stricter validation of concurrent operations within the extensions framework. For organizations unable to immediately patch all endpoints, implementing strict content security policies and restricting the installation of third-party browser extensions can reduce the attack surface. Additionally, monitoring for unusual process behavior originating from renderer processes may help detect exploitation attempts in real-time. This vulnerability aligns with MITRE ATT&CK technique T1055, specifically Process Injection or Privilege Escalation via Race Conditions, highlighting the importance of maintaining up-to-date software to prevent sandbox escapes that compromise system integrity.