CVE-2026-91724

CVE-2026-91724 is a high-severity use-after-free vulnerability in the Input component of Google Chrome, affecting all versions prior to 153.0.8010.47. It is triggered when a victim loads a crafted HTML page, but exploitation requires the attacker to have already compromised the browser's renderer process, typically by chaining this flaw with a separate renderer bug. Successful exploitation allows the attacker to escape Chrome's sandbox and execute arbitrary code with the privileges of the browser process on the victim's machine. All users running unpatched Chrome builds are affected, as are users of other Chromium-based browsers once vendors fold in the fix. There is no known public proof of concept, and the vulnerability is not listed in CISA's KEV catalog, indicating no confirmed in-the-wild exploitation at this time.

What to do: Update Google Chrome to version 153.0.8010.47 or later immediately, and confirm auto-update has propagated across managed fleets (check chrome://version or enterprise policy status). Because this is a sandbox-escape primitive that chains with renderer compromise, defenders should pair the update with monitoring for unusual child-process behavior from the browser. Users of Chromium-derived browsers such as Edge, Brave, Opera, and Vivaldi should also apply those vendors' updates as they land the same fix.