CVE-2026-91745 in Chrome
Summary
by MITRE • 09/15/2026
Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as a use-after-free flaw within the V8 JavaScript engine, which powers Google Chrome prior to version 153.0.8010.47, represents a critical memory safety issue that undermines the browser's sandboxing mechanisms. This type of error occurs when a program continues to use a pointer after it has been freed from memory, leading to undefined behavior that can be exploited by malicious actors. In this specific instance, an attacker could craft a specially designed HTML page containing JavaScript code that triggers the premature deallocation of a V8 object while retaining references to that same object elsewhere in the execution context. When the browser subsequently attempts to access or manipulate these stale pointers, it interacts with memory regions that may have been reallocated for different purposes, thereby allowing an attacker to control the flow of execution and potentially execute arbitrary code within the restricted environment of the Chrome sandbox.
From a technical perspective, this vulnerability falls under the category of CWE-416, which classifies use-after-free errors as a significant memory corruption issue. The exploitation of such flaws typically involves manipulating heap structures to achieve specific outcomes, such as overwriting function pointers or vtables, which are critical for object-oriented programming in C++ based engines like V8. By carefully crafting the HTML and JavaScript payload, an attacker can force the browser into a state where freed memory is reused in a way that grants control over program execution flow. This bypasses many of the standard mitigations employed by modern browsers because the exploit operates within the legitimate context of script execution, making it difficult for heuristic-based detection systems to identify without deep inspection of memory states.
The operational impact of this vulnerability is severe due to its potential for remote code execution via a simple web page visit. Since V8 handles all JavaScript parsing and compilation in Chrome, any malicious content embedded in an HTML document can trigger the flaw if the user interacts with it or if certain conditions are met automatically through script execution. This means that no additional plugins or external software installations are required by the victim; merely loading a compromised webpage is sufficient to initiate the attack chain. The high severity rating assigned by Chromium security reflects the ease of exploitation and the significant risk posed to end-users who may inadvertently visit malicious sites, leading to full system compromise if the sandbox escape succeeds in reaching higher privilege levels or accessing sensitive data stored locally on the device.
To mitigate this risk, users must ensure that their Google Chrome installation is updated to version 153.0.8010.47 or later, where patches for this memory safety issue have been implemented. These updates typically include rigorous checks during garbage collection and object lifecycle management within V8 to prevent dangling pointers from being dereferenced after deallocation. Additionally, organizations should enforce strict content security policies and utilize browser hardening techniques such as disabling unnecessary JavaScript features in untrusted environments where possible. From a defensive standpoint, monitoring for anomalous memory access patterns or unusual heap allocations can help detect attempts to exploit this vulnerability before successful execution occurs. Security teams should also remain vigilant against similar vulnerabilities classified under CWE-416 and monitor ATT&CK tactics related to initial access and privilege escalation via browser-based attacks to maintain robust defense-in-depth strategies against web-delivered threats.