CVE-2026-91715 in Chrome
Summary
by MITRE • 09/16/2026
Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as a type confusion flaw within the ServiceWorker component of Google Chrome prior to version 153.0.8010.47 represents a critical memory safety issue that undermines the browser's sandboxing mechanisms. Type confusion vulnerabilities occur when an application incorrectly handles data types, leading it to interpret one type of object as another during execution. In this specific instance, the flaw resides in how Chrome’s ServiceWorker runtime manages and casts objects within its internal structure. When a malicious actor crafts a specially designed HTML page that triggers these incorrect type interpretations, the browser fails to validate the expected properties or methods associated with an object before performing operations on it. This discrepancy allows for arbitrary memory reads or writes, which is particularly dangerous in web browsers where isolation between different origins and processes is paramount for security.
The operational impact of this vulnerability is severe because it facilitates remote code execution within the browser's sandboxed environment. ServiceWorkers are designed to act as network proxies, enabling features like offline caching and push notifications, but they operate with significant privileges relative to standard web pages due to their ability to intercept network requests. By exploiting the type confusion flaw, an attacker can bypass these intended restrictions and execute arbitrary code commands on the victim's system. Although Chrome employs multiple layers of defense such as sandboxing, heap spraying protections, and control flow integrity measures, a successful exploitation of this high-severity vulnerability allows the malicious payload to escape or operate within the context of the ServiceWorker process. This can lead to data exfiltration, installation of malware, or further lateral movement depending on the privileges granted to that specific browser process instance.
From a classification perspective, this flaw aligns with CWE-843, which describes access to incorrect type via reference, and is closely related to CWE-120, buffer overflow overruns, as improper type handling often leads to memory corruption issues like heap-based buffer overflows or use-after-free conditions in complex JavaScript engines. In terms of the MITRE ATT&CK framework, this vulnerability supports techniques associated with Initial Access through crafted content (T1189) and Execution via browser components (T1204). The attacker leverages social engineering or drive-by download tactics to host the malicious HTML page, which then exploits the logic error in Chrome’s ServiceWorker implementation. This category of exploit is particularly concerning because it targets a core component of modern web architecture that many users rely on for enhanced functionality and performance.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.47 or later, where the developers have patched the underlying logic error responsible for the type confusion. For organizations managing large fleets of devices, ensuring automatic updates are enabled is crucial to prevent exposure to such zero-day style exploits once they become public knowledge. Additionally, security administrators should consider implementing strict Content Security Policy (CSP) headers to limit the execution context and restrict inline scripts or unauthorized sources that might attempt to trigger similar vulnerabilities in unpatched systems. While browser sandboxing provides a robust defense-in-depth layer, it is not infallible against sophisticated memory corruption bugs, making timely patch management the most effective countermeasure against type confusion flaws in critical components like ServiceWorkers.