CVE-2026-91709

CVE-2026-91709 is a type confusion vulnerability (CWE-843) in the ServiceWorker component of Google Chrome in versions prior to 153.0.8010.47. A remote attacker can trigger the flaw by luring a victim to a maliciously crafted HTML page, which requires user interaction such as clicking a link, reflected in the CVSS 3.1 score of 8.8. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome renderer sandbox, which typically requires a separate sandbox escape for full host compromise but still constitutes a High-severity code execution primitive. All users running Google Chrome versions older than 153.0.8010.47 on any supported platform (Windows, macOS, Linux, Android) are affected. No public proof of concept is known and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, so exploitation is presumed none known at this time.

What to do: Update Google Chrome to version 153.0.8010.47 or later immediately; users can trigger the update manually at chrome://settings/help. Enterprise administrators should verify fleet-wide patch status via Chrome Browser Cloud Management or Group Policy and accelerate the auto-update rollout window. Because exploitation requires only a victim visiting a crafted page, remind users that email and messaging links are the likely delivery vector, and treat any post-patch crash reports from ServiceWorker-heavy sites as worth investigating.