CVE-2026-91718 in Chrome
Summary
by MITRE • 09/16/2026
Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability described constitutes a critical use-after-free flaw within the core rendering engine of Google Chrome, specifically affecting versions prior to 153.0.8010.47. This type of memory corruption error arises when an application continues to use a pointer after the memory it points to has been freed and potentially reallocated for other purposes. In the context of web browsers, such flaws are particularly dangerous because they occur within high-privilege processes that handle complex document object model manipulations and script execution. The root cause typically involves a failure in reference counting or lifecycle management where an object is deallocated while still being referenced by another part of the application logic, leading to undefined behavior when the stale pointer is accessed.
From a technical perspective, this vulnerability allows for arbitrary code execution outside the browser's sandbox environment. Modern browsers employ strict sandboxing mechanisms to isolate web content from the underlying operating system and user data. However, use-after-free vulnerabilities can be exploited to corrupt memory structures in ways that bypass these isolation boundaries. An attacker could craft a malicious HTML page containing specific JavaScript or embedded objects designed to trigger the premature deallocation of a critical object while maintaining a reference to it. By carefully controlling the allocation patterns following the free operation, an attacker can manipulate heap metadata or overwrite function pointers, ultimately achieving control over the instruction pointer and executing arbitrary shellcode with the privileges of the browser process.
The operational impact of this vulnerability is severe due to its remote exploitability vector. Since the attack surface involves a crafted HTML page, no user interaction beyond visiting a malicious website is required for exploitation in many scenarios, especially if combined with social engineering or drive-by download techniques. Successful exploitation grants an attacker full control over the victim's machine within the context of the browser process, which can lead to data theft, installation of persistent malware, or use as a pivot point for further network attacks. The Chromium security severity rating of High reflects the likelihood and ease of exploitation in real-world scenarios where such memory corruption bugs are frequently leveraged by advanced threat actors targeting high-value individuals or organizations.
This vulnerability aligns with CWE-416, Use After Free, which is categorized under CWE-120, Buffer Overflow, as it involves improper handling of allocated memory regions that can lead to arbitrary code execution. In terms of the MITRE ATT&CK framework, this exploit technique falls under T1203, Exploitation for Client Execution, and potentially T1059, Command and Scripting Interpreter, depending on how the attacker leverages the initial foothold. The ability to escape the sandbox places it in a higher tier of threat severity compared to same-origin policy violations or cross-site scripting issues that remain contained within the browser's security context.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.47 or later, where these memory management flaws have been patched by developers through improved reference counting and pointer invalidation practices. Organizations should enforce automated update policies for all endpoints running this browser to ensure timely patching of critical vulnerabilities. Additionally, deploying endpoint detection and response solutions with behavioral analysis capabilities can help identify suspicious activities resulting from such exploits, such as unusual process spawning or memory access patterns indicative of heap exploitation attempts. Users are also advised to exercise caution when visiting untrusted websites and to enable built-in security features like site isolation and sandboxing enhancements provided by the browser vendor.