CVE-2026-91739 in Chrome
Summary
by MITRE • 09/15/2026
Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as missing authorization within the Transactions Platform of Google Chrome prior to version 153.0.8010.47 represents a critical failure in access control mechanisms that governs how user interface elements are rendered and authenticated during financial transactions. This flaw specifically impacts scenarios where the browser processes sensitive payment data, allowing for potential manipulation of the visual representation of transaction details without proper verification of the caller's authority to modify those specific UI components. The core technical issue lies in the insufficient validation of permissions when rendering dynamic content related to banking or e-commerce interfaces, which creates an avenue for user interface spoofing attacks that can deceive users into believing they are interacting with a legitimate financial institution rather than a malicious entity.
From a technical perspective, this vulnerability exploits the trust relationship between the renderer process and the browser's main thread regarding UI updates. When a remote attacker compromises the renderer process through other means such as exploiting an arbitrary code execution flaw or leveraging cross-site scripting vulnerabilities in untrusted web content, they gain the ability to inject crafted HTML pages that interact with the Transactions Platform APIs. Because of the missing authorization checks, these injected scripts can manipulate DOM elements associated with transaction confirmations, amounts, and recipient details without triggering appropriate security warnings or requiring explicit user consent for such modifications. This effectively bypasses standard browser safeguards designed to prevent UI redressing attacks where malicious overlays mimic legitimate login screens or payment dialogs.
The operational impact of this vulnerability is severe in the context of financial fraud and credential harvesting. By spoofing UI elements, an attacker can create a convincing facade that mimics trusted banking websites or payment gateways while secretly intercepting sensitive information such as credit card numbers, passwords, or two-factor authentication codes. Users may unknowingly enter their credentials into these manipulated interfaces because the visual presentation appears authentic due to the successful injection of legitimate-looking UI components from the compromised renderer process. This type of attack falls under the category of user interface redressing and is particularly dangerous because it relies on social engineering tactics amplified by technical exploitation, making detection difficult for end-users who rely heavily on visual cues to assess trustworthiness.
In terms of industry standards classification, this vulnerability aligns with CWE-269 which denotes Improper Authorization, as the system fails to enforce proper access controls when allowing modifications to sensitive UI states. Furthermore, it relates closely to ATT&CK technique T1078 Valid Accounts and potentially T1553 Site Spoofing if leveraged in conjunction with phishing campaigns, although the primary mechanism here is technical exploitation of a renderer process compromise rather than direct credential theft via social engineering alone. The severity rating assigned by Chromium as Medium reflects that while it requires an initial foothold within the sandboxed renderer environment, the resulting capability to manipulate critical financial interfaces significantly elevates the risk profile compared to standard cross-site scripting issues because of the high-value targets involved in transaction processing workflows.
Mitigation strategies primarily involve ensuring all users upgrade to Google Chrome version 153.0.8010.47 or later where these authorization checks have been reinforced within the Transactions Platform codebase. For organizations deploying enterprise versions, it is advisable to enforce automatic update policies to minimize exposure windows during which older vulnerable builds remain in use. Additionally, implementing strict Content Security Policy directives can help mitigate some aspects of renderer-based UI manipulation by restricting script execution contexts and preventing unauthorized DOM modifications from external sources. Security teams should also monitor for anomalous behavior patterns associated with transaction platforms that might indicate active exploitation attempts, such as unexpected changes to form fields or submission actions originating from non-standard origins within the browser session context.