CVE-2026-91721 in Chrome
Summary
by MITRE • 09/16/2026
Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as a use-after-free flaw within the Internals component of Google Chrome prior to version 153.0.8010.47 represents a critical memory management error that undermines the browser's core security architecture. This specific class of vulnerabilities occurs when a program continues to use a pointer after the memory it points to has been freed, often leading to undefined behavior such as crashes or arbitrary code execution. In this instance, the flaw resides in the internal handling mechanisms of Chrome, which are responsible for managing resources and state during browser operations. The severity is classified as Critical by Chromium security standards because it allows a remote attacker to potentially execute arbitrary code outside the sandbox environment that typically isolates web content from the host operating system.
The technical mechanism behind this vulnerability involves improper memory deallocation practices within the Internals subsystem. When an object or data structure is no longer needed, Chrome should release its associated memory and nullify references to it. However, due to a logic error in the codebase prior to the specified patch version, certain pointers remained valid even after their underlying memory was returned to the system allocator. An attacker could exploit this by crafting a malicious HTML page that triggers specific JavaScript operations or DOM manipulations designed to force the premature freeing of these internal objects while retaining active references to them elsewhere in the execution context. This discrepancy creates a window where the browser attempts to access freed memory, which may still contain data from previous allocations or be mapped to attacker-controlled regions.
The operational impact of this vulnerability is severe due to its potential for sandbox escape. Modern browsers rely heavily on multi-process architectures and sandboxes to limit the damage caused by compromised web pages. By exploiting a use-after-free condition in an internal component, an attacker can manipulate memory layout and control flow redirections, such as overwriting function pointers or virtual table entries. This manipulation allows the execution of arbitrary shellcode with the privileges of the browser process rather than being confined to the restricted sandboxed renderer context. Consequently, this could lead to full system compromise, allowing the installation of malware, theft of sensitive data stored locally, or use of the machine as part of a botnet without user interaction beyond visiting the crafted webpage.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-416, which describes Use After Free conditions that lead to memory corruption and potential code execution. Furthermore, from an offensive security perspective, this exploit path is consistent with MITRE ATT&CK techniques related to initial access via browser exploitation and privilege escalation through sandbox escapes. The ability to execute code outside the sandbox effectively bypasses several layers of defense-in-depth strategies employed by modern web browsers, making it a high-value target for threat actors seeking persistent access or lateral movement within an organization's network infrastructure.
Mitigation requires immediate updating of Google Chrome to version 153.0.8010.47 or later, where the memory management logic in the Internals component has been corrected to ensure that pointers are properly invalidated after deallocation and that checks are implemented to prevent access to freed memory. Organizations should enforce automated patching policies for all endpoints running Chrome to minimize exposure windows. Additionally, security teams can employ browser hardening techniques such as disabling JavaScript execution on untrusted sites or using extensions that restrict DOM manipulation capabilities where feasible. Monitoring network traffic for unusual outbound connections following visits to unknown web resources may also help detect potential exploitation attempts in real-time, although prevention through patching remains the most effective control against this specific memory corruption flaw.