CVE-2026-91741 in Chrome
Summary
by MITRE • 09/15/2026
Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as a type confusion flaw within the CacheStorage component of Google Chrome prior to version 153.0.8010.47 represents a critical memory safety issue that undermines the browser's sandboxing mechanisms. Type confusions occur when an application incorrectly interprets the data type of a variable or object, leading to operations being performed on data structures in ways they were not intended. In this specific instance, the flaw resides within CacheStorage, a feature designed to allow web applications to store and retrieve cached resources for improved performance and offline functionality. The underlying technical defect involves an inconsistency in how Chrome handles memory allocation and type checking during cache operations, allowing a crafted HTML page hosted by a remote attacker to manipulate internal object states improperly.
From a technical perspective, this vulnerability falls under the category of CWE-843, which refers to Access of Incorrect Type or Misinterpretation of Assumed Correct Type. The exploitation vector relies on the browser's ability to be tricked into treating one data structure as another, typically leading to out-of-bounds reads or writes when memory is accessed based on incorrect assumptions about object size or layout. By crafting a specific HTML page that triggers this misinterpretation during cache storage retrieval or manipulation, an attacker can achieve arbitrary code execution within the browser's sandbox environment. This bypasses standard security boundaries because the malicious payload executes with the privileges of the compromised process rather than being contained by stricter isolation policies.
The operational impact of this vulnerability is severe due to its potential for remote exploitation without user interaction beyond visiting a malicious webpage. The Chromium project has classified this issue as High severity, reflecting the likelihood and ease of exploitation given modern browser features that facilitate such attacks. Successful exploitation allows an attacker to execute arbitrary code inside the sandbox, which can lead to further privilege escalation if additional vulnerabilities are chained together or if the sandbox escape is achieved through other means. This compromises user confidentiality by allowing data exfiltration and integrity by enabling unauthorized modifications to system state or installed extensions.
To mitigate this risk, users must ensure that their Google Chrome installation is updated to version 153.0.8010.47 or later, where the type confusion logic has been corrected with proper bounds checking and type validation routines. For enterprise environments, implementing strict content security policies can help reduce the attack surface by limiting which scripts are allowed to interact with CacheStorage APIs. Additionally, enabling sandboxing features such as site isolation ensures that even if a vulnerability is exploited in one context, it does not grant access to sensitive data from other sites. Monitoring for unusual memory allocation patterns or browser crashes may also serve as an indicator of attempted exploitation attempts before the patch is applied.
This incident highlights the ongoing challenges associated with complex web platform features like CacheStorage and underscores the importance of rigorous static analysis and fuzzing in browser development cycles. The vulnerability aligns with ATT&CK techniques related to initial access via spearphishing links or drive-by downloads, specifically leveraging software vulnerabilities for execution. Maintaining up-to-date security patches remains the most effective defense against such memory corruption flaws that target core browser components.