CVE-2026-91730 in Chrome
Summary
by MITRE • 09/16/2026
Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Google Chrome prior to version 153.0.8010.47 represents a critical failure in resource management within the GetUserMedia API implementation, specifically categorized under CWE-404 as an improper explicit release of resources after successful acquisition or CWE-252 for unchecked return values leading to incomplete cleanup. This flaw occurs when the browser fails to properly terminate and clean up media streams or associated internal state objects following their intended use or termination. In a typical web browsing scenario, GetUserMedia is designed to request access to user hardware such as cameras and microphones, establishing secure channels that are expected to be fully isolated from other contexts upon closure. However, the incomplete cleanup mechanism leaves residual references or memory allocations active in ways that can be exploited by an attacker who has already achieved a foothold within the renderer process of a compromised tab.
The operational impact of this vulnerability is significant because it facilitates cross-origin data leakage, which directly undermines the browser's same-origin policy and isolation boundaries. An adversary leveraging social engineering techniques to trick a user into visiting a malicious HTML page can exploit this state inconsistency. By crafting specific interactions with media APIs, the attacker can trigger conditions where sensitive information from one origin remains accessible or inferable by another origin due to the lingering artifacts of incomplete cleanup. This allows for potential surveillance scenarios where audio or video data intended for temporary use is inadvertently exposed, or it enables further exploitation vectors that rely on residual state manipulation within the renderer process. The severity is classified as medium because while it requires initial compromise of the renderer and social engineering, the resulting cross-origin access can lead to substantial privacy violations and potential escalation of privileges if combined with other vulnerabilities.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK techniques related to Collection via Screen Capture or Audio Capture, specifically T1113 and T1123 respectively, as it involves the unauthorized acquisition of user media data. It also touches upon Defense Evasion tactics where an attacker might use these residual states to maintain persistence or avoid detection by leaving minimal traces while still exfiltrating data. The exploitation path typically begins with a compromised renderer process, which is often achieved through other web-based vulnerabilities such as cross-site scripting or remote code execution in plugins. Once inside the renderer, the attacker crafts HTML pages that interact with GetUserMedia APIs to trigger the incomplete cleanup state, thereby creating an avenue to access data across origin boundaries that should remain strictly isolated.
Mitigation strategies for this vulnerability primarily involve updating Google Chrome to version 153.0.8010.47 or later, where the developers have addressed the resource management flaws in the GetUserMedia implementation. Organizations and individual users must ensure automatic updates are enabled to receive these security patches promptly. Additionally, from a defensive posture perspective, implementing strict Content Security Policies can help mitigate some risks by restricting which origins are allowed to request media access, although this does not fully prevent exploitation if the renderer is already compromised. Users should remain vigilant against social engineering attempts that prompt them to grant camera or microphone permissions to untrusted websites, as these interactions serve as the primary vector for triggering the vulnerability. Regular audits of browser configurations and adherence to industry standards such as OWASP guidelines for web application security can further reduce the attack surface by minimizing unnecessary media access requests and ensuring proper session termination practices are enforced at the application level.