CVE-2026-91732 in Chrome
Summary
by MITRE • 09/16/2026
Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Google Chrome prior to version 153.0.8010.47 represents a critical failure in access control mechanisms within the AppManifest component of the Chromium browser engine. This flaw stems from an insufficient authorization check that allows processes with lower privileges, specifically compromised renderer processes, to interact with higher-privilege components or resources without proper verification. In modern web browsers like Chrome, security is maintained through a multi-process architecture where each tab and extension runs in its own sandboxed environment known as the renderer process. These environments are designed to isolate untrusted content from sensitive system resources and user data. However, when an attacker successfully compromises a renderer process, typically through exploiting another vulnerability or via malicious script execution, they gain a foothold within this isolated zone. The absence of strict authorization checks in the AppManifest handling logic creates a bridge that allows these low-privilege processes to escalate their privileges by accessing restricted APIs or manifest data intended only for trusted contexts.
The operational impact of this flaw is significant because it facilitates a bypass of web origin policies, which are fundamental security constructs designed to prevent malicious scripts on one site from interacting with content from another site. By leveraging social engineering techniques such as phishing pages crafted specifically to exploit this condition, an attacker can trick users into loading malicious HTML that triggers the unauthorized access path. Once triggered, the compromised renderer process can read or modify application manifest data, potentially leading to further exploitation vectors including session hijacking, credential theft, or lateral movement within a user's browsing context. The Chromium security team has classified this issue with a medium severity rating, reflecting its potential for abuse under specific conditions requiring both technical compromise and human interaction, yet acknowledging the serious implications if such an attack chain is successfully executed against high-value targets.
From a classification perspective, this vulnerability aligns closely with CWE-269, which denotes Improper Privilege Management, specifically where authorization checks are missing or ineffective during critical operations. It also relates to CWE-862, Missing Authorization, as the system fails to verify whether the requesting entity has the necessary permissions before allowing access to protected resources. In terms of offensive security frameworks like MITRE ATT&CK, this behavior corresponds to techniques involving privilege escalation and defense evasion, particularly within the context of browser-based attacks where attackers exploit trust relationships between different parts of a software application. The reliance on social engineering highlights the importance of user awareness alongside technical controls, as pure automated exploitation may be difficult without some form of initial user interaction or prior compromise of the renderer environment.
Mitigation strategies for this vulnerability primarily involve updating to Google Chrome version 153.0.8010.47 or later, which includes patches that enforce stricter authorization checks within the AppManifest handling logic. Organizations should ensure automatic update policies are enabled across all endpoints to minimize exposure windows. Additionally, implementing strict Content Security Policy headers can help mitigate some downstream effects by restricting how scripts interact with manifest data and other sensitive resources. Security teams should also monitor for indicators of compromise associated with renderer process anomalies or unusual network requests originating from browser processes, as these may signal active exploitation attempts targeting this specific flaw. Regular audits of web application security controls and adherence to secure coding practices that emphasize least privilege principles are essential preventive measures against similar access control failures in future software versions.