CVE-2026-91712

CVE-2026-91712 is a time-of-check/time-of-use race condition (CWE-367) in the Extensions component of Google Chrome on macOS, fixed in version 153.0.8010.47. A remote attacker first compromises the browser's renderer process by luring a victim to a crafted HTML page, then exploits the race to potentially execute arbitrary code outside the Chrome sandbox. Successful exploitation gives the attacker code execution at the browser user's privilege level, defeating Chrome's core sandbox isolation, with high impact on confidentiality, integrity, and availability (CVSS 8.3). The attack requires user interaction and high attack complexity because it depends on reliably winning the race, and it presupposes an initial renderer compromise. No public proof-of-concept exists, the flaw is not in CISA's KEV catalog, and no exploitation has been observed in the wild.

What to do: Update Google Chrome on macOS to version 153.0.8010.47 or later immediately (check chrome://settings/help), and confirm automatic updates are enabled for all users. Enterprise admins should verify fleet-wide patch levels via policy and expedite the rollout to managed Macs. Because exploitation requires an initial renderer compromise via a malicious page, also reinforce defenses such as site filtering and Safe Browsing enforcement, but treat patching as the primary mitigation.