CVE-2026-91708

CVE-2026-91708 is a time-of-check/time-of-use race condition (CWE-367) in the Network component of Google Chrome that allows a remote attacker who has already compromised the renderer process to obtain cross-origin data, breaking the browser's Same-Origin Policy. The attack is triggered when a victim loads a crafted HTML page, and the attacker gains the ability to read data belonging to other origins; Chromium's security team rated the bug High severity, while the standalone CVSS of 3.1 is low because exploitation requires user interaction, high attack complexity, and a pre-existing renderer compromise. All users running Chrome versions prior to 153.0.8010.47 are affected, with the fix shipped in the Chrome 153 update that resolved 42 security flaws. No public proof-of-concept exists, the CVE is not on CISA's KEV list, and there is no evidence of in-the-wild exploitation. In practice this flaw serves as a privilege-escalation step chained after a separate renderer-compromise bug rather than a standalone attack.

What to do: Update Google Chrome to version 153.0.8010.47 or later and verify via Help > About Chrome or chrome://version, confirming that enterprise update policies are not delaying rollout. Because exploitation requires an already-compromised renderer, treat this as a chain component: prioritize prompt patching of renderer-layer vulnerabilities as well. Chromium-based browsers (Edge, Brave, Opera, Vivaldi) inherit the affected Network code, so apply their corresponding security updates when they ship.