CVE-2026-91735 in Chrome
Summary
by MITRE • 09/15/2026
Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as an incorrect authorization flaw within the WebUI component of Google Chrome prior to version 153.0.8010.47 represents a critical breach in the browser's sandboxing architecture. This issue specifically affects the privilege separation model that isolates untrusted web content from sensitive system resources and internal browser processes. In modern browsers, the renderer process is designed to operate with minimal privileges, effectively containing any malicious code executed within it to prevent access to the host operating system or other critical components. However, this vulnerability allows a remote attacker who has already achieved execution within the compromised renderer process via a crafted HTML page to bypass these restrictions and execute arbitrary code outside of the sandbox environment.
From a technical perspective, the flaw stems from an improper check on authorization tokens or permissions when handling requests directed at internal WebUI endpoints. These endpoints are typically reserved for privileged operations managed by higher-privilege browser processes such as the browser process itself. When the renderer interacts with these interfaces without adequate validation of its authority to do so, it can trigger actions that require elevated privileges. This misconfiguration effectively neutralizes the security boundary intended to protect the user's system from malicious web content. The attacker leverages this gap by crafting a specific HTML page containing exploit code designed to interact with vulnerable WebUI APIs or endpoints, thereby escalating their access level from a confined sandboxed environment to one capable of direct interaction with the underlying operating system.
The operational impact of this vulnerability is severe due to its potential for remote code execution and privilege escalation. An attacker can distribute malicious web content through phishing campaigns, compromised websites, or drive-by downloads. Once a victim visits the crafted page while using an affected version of Chrome, the exploit triggers the authorization flaw, allowing the renderer process to execute commands with higher privileges than intended. This capability enables the installation of malware, theft of sensitive data stored locally on the device, modification of system configurations, and further lateral movement within networked environments. The severity is classified as High by Chromium security standards because it undermines one of the most fundamental defenses against web-based attacks: process isolation.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically where an actor obtains privileges that are not properly restricted or verified. Furthermore, in terms of the MITRE ATT&CK framework, this exploit technique relates to T1055, Process Injection, and potentially T1059, Command and Scripting Interpreter, as it allows code execution outside the expected sandbox boundaries. It also reflects aspects of T1211, Exploitation for Defense Evasion, by bypassing security mechanisms designed to contain threats within limited contexts.
Mitigation strategies primarily involve immediate software updates. Users should upgrade Google Chrome to version 153.0.8010.47 or later, where the authorization checks in the WebUI have been corrected to ensure that renderer processes cannot access privileged endpoints without proper validation. For organizations managing large deployments of browsers, automated patch management systems should be configured to prioritize this update due to its high severity and active exploitation potential. Additionally, implementing strict Content Security Policies (CSP) can help mitigate some risks by restricting the sources from which scripts are loaded, although CSP alone cannot fully prevent exploits that target browser internals through legitimate rendering paths. Network-level controls such as web filtering proxies may also be employed to block access to known malicious domains hosting similar exploit kits until all endpoints are patched.