CVE-2026-91710

CVE-2026-91710 is a use-after-free vulnerability (CWE-416) in the WebAppInstalls component of Google Chrome in versions prior to 153.0.8010.47. A remote attacker can trigger the memory corruption by convincing a victim to visit a crafted HTML page, and successful exploitation yields arbitrary code execution outside the browser sandbox — meaning full compromise of the underlying operating system user account rather than a contained renderer crash. All desktop users running Chrome older than 153.0.8010.47 are affected, and the flaw is rated High severity by the Chromium security team. The fix shipped as part of the Chrome 153 stable update, which resolved 42 security flaws including three rated critical. No CVSS score has been assigned yet, the CVE is not on the CISA Known Exploited Vulnerabilities list, and no public proof of concept is known at this time.

What to do: Update Google Chrome to version 153.0.8010.47 or later immediately; desktop auto-updates typically roll out within days, so verify via Help > About Chrome on all workstations. Enterprise and IT admins should confirm fleet-wide patch status through their management console and expedite updates for any lagging endpoints. Because exploitation is via crafted web pages, users on affected builds should avoid untrusted links until patched, and defenders should watch for post-patch reports of in-the-wild exploitation, which is common for Chrome use-after-free bugs.