CVE-2026-91731

CVE-2026-91731 is a high-severity type confusion flaw (CWE-843) in the Compositing component of Google Chrome in versions prior to 153.0.8010.47. It is triggered remotely when a victim visits a crafted HTML page, requiring no privileges or attacker access to the target, only user interaction such as clicking a malicious link. Successful exploitation lets the attacker execute arbitrary code inside the browser's renderer sandbox, so an attacker controls the compromised tab process but would need a separate sandbox escape to reach the host system. All users running Chrome older than 153.0.8010.47 on any platform are affected, and Chromium-derived browsers typically inherit the vulnerable code until they ship the corresponding fix. No public proof-of-concept is known, the CVE is not on CISA's KEV list, and no exploitation in the wild has been reported.

What to do: Update Google Chrome to version 153.0.8010.47 or later immediately (Settings → About Chrome forces the update check). Enterprise administrators should confirm auto-update policies are not withholding the fixed build and push it fleet-wide, and users of Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi should apply those vendors' updates once they incorporate the fix. Because exploitation is confined to the renderer sandbox, keep site isolation and the operating-system sandbox enabled to limit damage if the bug is chained with a sandbox escape.