CVE-2026-91736 in Chrome
Summary
by MITRE • 09/15/2026
Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability described constitutes a critical use-after-free flaw within the Document Object Model implementation of Google Chrome, specifically affecting versions prior to 153.0.8010.47. This type of memory corruption error arises when the browser continues to reference a pointer after the memory it points to has been freed and potentially reallocated for other purposes. In the context of web browsing, this typically occurs during complex interactions with dynamic HTML content where JavaScript manipulates DOM elements in ways that trigger premature deallocation while references remain active within internal data structures or event handlers. The severity is classified as high by Chromium security standards because such memory corruption bugs are frequently exploited to achieve arbitrary code execution, representing one of the most dangerous classes of vulnerabilities in modern web browsers.
From a technical perspective, the flaw allows a remote attacker to craft an HTML page that triggers this specific race condition or logic error within the DOM engine. When the browser processes the malicious content, it frees memory associated with certain objects but retains pointers to those freed regions. By carefully controlling the allocation patterns in subsequent operations, an attacker can force the system to allocate new data at the same memory address as the previously freed object. If this newly allocated data contains controlled values crafted by the attacker, writing to or reading from these stale pointers allows for arbitrary read and write primitives. These primitives are essential stepping stones for bypassing modern browser security mitigations such as Control Flow Integrity and Data Execution Prevention, ultimately leading to full code execution within the renderer process sandbox.
The operational impact of this vulnerability is severe due to its potential for remote exploitation via a simple web page visit or through malicious advertising scripts embedded in legitimate sites. An attacker does not need physical access or user interaction beyond loading the crafted URL. Once executed inside the browser's sandbox, the compromised renderer process can attempt further exploits to escape the sandbox boundary and gain control over the host operating system. This could result in unauthorized data exfiltration, installation of persistent malware, or use of the infected machine as part of a botnet. The presence of this flaw highlights the ongoing challenges in maintaining memory safety within complex software systems like web browsers that must handle untrusted input from the internet while enforcing strict isolation boundaries.
Mitigation strategies primarily involve immediate patching to version 153.0.8010.47 or later, which includes fixes for the underlying DOM logic errors responsible for this use-after-free condition. Organizations should ensure automated update mechanisms are in place to minimize exposure windows. Additionally, defense-in-depth measures such as enabling strict Content Security Policies can help mitigate some exploitation vectors by restricting script execution contexts. From a classification standpoint, this vulnerability aligns with CWE-416 Use After Free and is often associated with ATT&CK techniques related to initial access via spearphishing links or drive-by downloads where the browser serves as the attack vector for subsequent lateral movement or persistence within an enterprise environment.