CVE-2026-91721

CVE-2026-91721 is a critical use-after-free flaw (CWE-416) in Chrome's Internals component affecting versions prior to 153.0.8010.47. A remote attacker triggers it by convincing a user to visit a crafted HTML page, which corrupts freed memory and can lead to arbitrary code execution outside the browser sandbox — a full compromise of the victim's machine rather than a sandboxed renderer compromise. The issue carries a CVSS 3.1 score of 8.8 (network vector, low complexity, no privileges, but user interaction required) and was rated Critical by the Chromium security team. All users of Google Chrome on any platform who have not updated to 153.0.8010.47 or later are affected, with downstream Chromium-based browsers potentially inheriting the flaw. No public proof of concept is known and the vulnerability is not listed in CISA's KEV catalog, so no in-the-wild exploitation has been confirmed at this time.

What to do: Update Google Chrome to version 153.0.8010.47 or later immediately (Help > About Google Chrome, or via enterprise policy), and verify the version across managed fleets. Organizations running Chromium-derived browsers (Edge, Brave, Opera, Vivaldi, etc.) should apply those vendors' equivalent updates once released, since they inherit the vulnerable Blink/V8 codebase. Because exploitation requires only a user clicking a crafted link, consider reinforcing phishing defenses and enabling Chrome's automatic update policies for managed devices.