CVE-2026-91734 in Chrome
Summary
by MITRE • 09/16/2026
Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as an incorrect authorization flaw within the core components of Google Chrome on Windows operating systems prior to version 153.0.8010.47 represents a significant breach in process isolation and privilege management. This issue stems from improper access control checks that fail to adequately restrict how local programs interact with sensitive browser processes or system resources. In modern web browsers, the architecture relies heavily on sandboxing techniques to confine potentially malicious code executed within tab contexts, thereby preventing it from accessing critical operating system files, registry keys, or other user data. When authorization logic is flawed, this protective boundary can be bypassed by a local attacker who has already achieved some level of access to the machine.
From a technical perspective, the flaw allows an adversary running arbitrary code on the victim's device to escalate privileges beyond the confines of the browser sandbox. By exploiting specific APIs or inter-process communication channels that were not properly secured against unauthorized invocation, the attacker can execute commands with higher system permissions than intended by the application design. This type of vulnerability is often categorized under CWE-269, which denotes Improper Privilege Management, as it involves a failure to enforce proper rights and privileges for users or processes. The exploitation typically requires the attacker to have local access, meaning they must already be able to run code on the target system, but the impact extends far beyond that initial foothold by granting control over core browser functions and potentially broader system resources.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution outside the sandbox environment. Once an attacker successfully exploits this authorization flaw, they can execute malicious payloads with elevated privileges, effectively compromising the integrity and confidentiality of the user's data. This could lead to full system compromise if the browser process runs with sufficient permissions or if the exploit chain leverages additional local vulnerabilities to further escalate rights. The Chromium security severity rating of High reflects the critical nature of this breach in isolation mechanisms, which are fundamental to modern web security models. Attackers can use this capability to install persistent backdoors, exfiltrate sensitive information such as saved passwords and cookies, or pivot into other parts of a corporate network if the compromised machine serves as an entry point.
To mitigate the risks associated with this vulnerability, it is imperative for users and system administrators to update Google Chrome immediately to version 153.0.8010.47 or later, where these authorization checks have been corrected. Regular patching cycles are essential in maintaining a secure posture against such privilege escalation flaws. Additionally, organizations should enforce strict application whitelisting policies to prevent unauthorized local programs from interacting with browser processes. Implementing least-privilege principles for user accounts and employing endpoint detection and response solutions can also help identify and block suspicious activities that attempt to exploit these authorization gaps. Monitoring for unusual process creation events or privilege changes within the Chrome execution context can provide early warning indicators of exploitation attempts aligned with techniques described in MITRE ATT&CK frameworks related to local privilege escalation and defense evasion.