CVE-2026-91711

CVE-2026-91711 is a high-severity out-of-bounds write (CWE-787) in the ServiceWorker component of Google Chrome, assigned by Google's Chrome CVE admin. A remote attacker triggers the flaw by luring a victim to a crafted HTML page that abuses the ServiceWorker subsystem to corrupt memory, allowing arbitrary code execution inside the Chrome sandbox. Successful exploitation gives the attacker code execution in the renderer process of the compromised tab, which typically still requires a separate sandbox escape for full host compromise. All users running Chrome versions prior to 153.0.8010.47 on any platform are affected; the fix shipped in the Chrome 153 stable update that resolved 42 security flaws, including 3 rated critical. No public proof of concept is known and the issue is not in CISA's Known Exploited Vulnerabilities catalog, so there is no evidence of in-the-wild exploitation at this time.

What to do: Update Google Chrome to version 153.0.8010.47 or later immediately and verify the version via chrome://settings/help. Enterprise administrators should confirm managed devices have applied the update and consider accelerating the auto-update rollout given the potential for web-drive-by exploitation. Users of Chromium-derived browsers (e.g., Edge, Brave, Opera, Vivaldi) should also apply their vendors' updates as the underlying Chromium fix is backported.