CVE-2026-91725 in Chrome
Summary
by MITRE • 09/16/2026
Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as an observable discrepancy in Cascading Style Sheets within versions of Google Chrome preceding 153.0.8010.47 represents a significant class of side-channel attacks known as CSS-based information leakage. This flaw exploits the intricate relationship between how browsers render web content and how they handle style calculations for elements that are visually hidden or manipulated via CSS properties such as display, visibility, clip-path, or overflow. When an attacker crafts a malicious HTML page containing specific CSS rules designed to trigger these discrepancies, it creates a measurable difference in rendering behavior depending on the underlying state of the victim's browser environment. This discrepancy is not merely cosmetic but serves as a conduit for extracting sensitive data that should remain inaccessible to unprivileged web content.
From a technical perspective, this vulnerability falls under the category of timing attacks or side-channel vulnerabilities where the attacker infers private information by observing changes in system behavior rather than through direct memory access or logical flaws in authentication mechanisms. The core issue lies in how Chrome processes style recalculation and layout updates for elements that are ostensibly hidden from view but still exist within the Document Object Model. By carefully constructing CSS selectors and properties, an attacker can force the browser to perform different computational paths based on whether certain sensitive attributes, such as autofill values or internal state flags, are present or absent in the DOM. These differences manifest as variations in rendering time or layout dimensions that can be detected by JavaScript running within the malicious page.
The operational impact of this vulnerability is severe because it enables remote attackers to exfiltrate sensitive user data without requiring any interaction beyond visiting a compromised website. This could include personal identifiable information such as names, addresses, credit card numbers stored in browser autofill databases, or other session-specific tokens that are tied to the visual state of form elements. Since this attack vector relies on standard web technologies like HTML and CSS, it bypasses many traditional security controls designed for cross-site scripting or direct code injection attacks. The attacker does not need to execute arbitrary JavaScript payloads but rather leverages the browser's own rendering engine against itself to leak data through observable discrepancies in style application.
This type of vulnerability is closely aligned with CWE-200, which classifies it as an Information Exposure Vulnerability, specifically where sensitive information is disclosed due to inadequate protection mechanisms during processing or display. In terms of offensive security frameworks, this technique maps directly to the MITRE ATT&CK tactic of Collection via Browser-based Exfiltration and potentially Cross-Site Scripting if combined with other vectors for initial access. The medium severity rating assigned by Chromium reflects the complexity required to craft effective exploits versus the high value of the data that can be stolen once successful exploitation occurs.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.47 or later, where these rendering discrepancies have been addressed through stricter isolation of style calculations and improved handling of hidden elements. For organizations unable to patch immediately, implementing strict Content Security Policy directives can help mitigate the risk by restricting the execution of untrusted scripts that might attempt to measure these timing differences. Additionally, disabling JavaScript for unknown sites or using browser extensions that enforce privacy-focused rendering behaviors can reduce the attack surface available to such side-channel exploits until a permanent fix is deployed across all client systems.