CVE-2026-91746 in Chrome
Summary
by MITRE • 09/16/2026
Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as an integer overflow within the compositing subsystem of Google Chrome represents a critical failure in memory management and bounds checking during the rendering pipeline. This flaw, present in versions prior to 153.0.8010.47, stems from improper arithmetic operations when calculating buffer sizes or offsets for composited layers. In modern web browsers, compositing is responsible for combining multiple visual elements into a final image displayed on screen. When an attacker crafts a malicious HTML page that triggers specific rendering conditions, they can cause the browser to miscalculate memory allocations due to integer wraparound behavior. This mathematical error allows the application to allocate insufficient memory or write beyond allocated boundaries, leading to heap corruption or arbitrary read/write capabilities within the renderer process context.
From a technical perspective, this vulnerability falls under CWE-190 Integer Overflow or Wraparound and is closely related to CWE-787 Out-of-bounds Write if it leads to memory corruption that can be exploited for code execution. However, in this specific instance, the primary impact described is data exfiltration rather than remote code execution. The attacker leverages the compositing engine's handling of layer boundaries and texture uploads to bypass standard security controls. By carefully constructing a webpage with crafted CSS properties or canvas elements, the adversary can manipulate how Chrome calculates memory offsets for visual layers. This manipulation results in the browser exposing internal state information that should remain isolated from other origins.
The operational impact of this vulnerability is significant due to its potential to facilitate cross-origin data theft. Cross-Origin Resource Sharing (CORS) and same-origin policies are fundamental security mechanisms designed to prevent malicious sites from accessing sensitive data hosted on different domains. By exploiting the integer overflow in compositing, an attacker can potentially read memory contents belonging to other tabs or origins that share the same renderer process. This could lead to the leakage of cookies, session tokens, authentication credentials, or private user content stored within web applications running in separate contexts. The severity is classified as High because it undermines the core isolation model of the browser, allowing a remote attacker to achieve unauthorized access to confidential information without requiring any user interaction beyond visiting the malicious webpage.
This attack vector aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter if used in conjunction with other exploits, but more directly relates to T1213 Data from Information Repositories or potentially T1074 Data Staged for Exfiltration depending on the final payload. It also touches upon T1608 Install Definite Malware if the initial access leads further down a chain of exploitation. The ability to obtain cross-origin data effectively breaks the sandbox boundaries that protect users from malicious websites, making this a serious privacy and security concern.
Mitigation for this vulnerability requires immediate updating to Google Chrome version 153.0.8010.47 or later, where the integer overflow in the compositing logic has been patched with proper bounds checking and arithmetic validation. Organizations should enforce automated browser update policies across all endpoints to ensure that users are protected against known rendering engine flaws. Additionally, implementing strict Content Security Policy (CSP) headers can help mitigate some downstream effects by restricting how scripts interact with page content, although it does not directly prevent exploitation of low-level memory errors like this one. Users should also be educated about the risks of visiting untrusted websites and utilizing browser extensions that enhance security posture, such as script blockers or privacy-focused add-ons, to reduce the attack surface available to remote attackers attempting to leverage rendering engine vulnerabilities for data theft.