CVE-2026-91714 in Chrome
Summary
by MITRE • 09/16/2026
Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as an observable discrepancy in font rendering within versions of Google Chrome prior to 153.0.8010.47 represents a classic side-channel attack vector rooted in timing and visual analysis techniques. This flaw allows a remote attacker, who typically relies on social engineering tactics such as phishing or malicious web content delivery, to extract sensitive information from the victim's system without direct access to memory or file systems. The core of this vulnerability lies in how the browser handles font metrics and rendering differences across different operating environments. By crafting specific HTML pages that manipulate text layout and font loading, an attacker can create conditions where the time taken to render certain characters or the visual appearance of those characters varies based on whether a particular font is installed locally on the victim's machine. This discrepancy serves as a binary signal, enabling the extraction of data bit by bit through careful observation of rendering times or pixel-level differences in the rendered output.
From a technical perspective, this vulnerability exploits the deterministic nature of font substitution and metric calculation within the Chromium engine. When a web page requests a specific font family that is not present on the local system, the browser must fall back to an alternative font. The metrics such as width, height, and kerning pairs differ between fonts, leading to subtle variations in how text wraps or aligns on the screen. Attackers leverage these micro-variations by embedding hidden elements or using CSS properties that force specific layout behaviors. By measuring the time it takes for the browser to resolve font availability or observing slight shifts in element positioning caused by different font widths, an attacker can infer the presence of specific files or configurations on the target system. This technique is particularly dangerous because it operates entirely within the sandboxed environment of the web page, bypassing traditional network-based security controls and relying instead on local resource enumeration through side channels.
The operational impact of this vulnerability extends beyond simple information disclosure to potential privacy breaches and targeted attacks. Sensitive data such as installed software lists, user profile paths, or even specific configuration details can be exfiltrated with high accuracy given enough time and samples. This capability significantly lowers the barrier for further exploitation stages, as knowledge of the victim's environment allows attackers to tailor subsequent payloads more effectively. For instance, knowing which security tools are installed might allow an attacker to disable specific defenses during a follow-up attack. The severity is classified as medium by Chromium because while it does not directly lead to arbitrary code execution or full system compromise on its own, it provides critical intelligence that facilitates deeper intrusions and violates the principle of least privilege regarding local resource visibility.
Mitigation strategies primarily involve updating to version 153.0.8010.47 or later, where Google has implemented fixes to normalize font rendering behavior and obscure these discrepancies from web pages. In addition to patching, administrators should enforce strict Content Security Policy (CSP) directives that restrict access to local resources and limit the ability of scripts to measure precise timing metrics. Disabling JavaScript execution on untrusted sites can also mitigate this risk by preventing the automated measurement required for such side-channel attacks. Furthermore, users should be educated about the risks of interacting with unknown web content, as social engineering remains the primary delivery mechanism for exploiting this flaw. Regular security audits and monitoring for unusual browser behavior or unexpected network traffic patterns related to font services can help in detecting potential exploitation attempts before significant data loss occurs.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-208, which describes observable timing discrepancy, and CWE-209, regarding the generation of an error message that includes sensitive information. In terms of the MITRE ATT&CK framework, this technique falls under T1564.003, specifically Hidden Files and Directories, although it is adapted here for enumeration rather than concealment. It also relates to T1078, Valid Accounts, if used in conjunction with credential harvesting, but primarily sits within the reconnaissance phase of an attack lifecycle as a method for gathering environmental intelligence. Understanding these mappings helps security teams prioritize defenses against similar side-channel vulnerabilities that exploit subtle differences in system behavior to leak confidential data without triggering traditional intrusion detection systems.