CVE-2026-91734

Google Chrome on Windows contains an incorrect authorization flaw (CWE-863) in its Core component that lets a local attacker execute arbitrary code outside the browser's sandbox by abusing a local program. The vulnerability is triggered when an attacker already running code or a malicious program on the victim's machine exploits the authorization gap to break out of Chrome's sandbox, which is designed to contain compromised renderer processes. A successful escape grants the attacker execution with the privileges of the logged-in user outside the sandbox, enabling full compromise of confidentiality, integrity, and availability of the user's session. All Chrome versions on Windows prior to 153.0.8010.47 are affected, while other platforms (macOS, Linux, ChromeOS, Android) are not named as affected. Google rates this High severity (CVSS 7.4), and no public proof of concept or in-the-wild exploitation is currently known.

What to do: Update Chrome on Windows to version 153.0.8010.47 or later immediately; verify via Help > About Chrome, since auto-update may lag on managed or offline machines. Enterprises should confirm fleet-wide patch status through browser management tools and treat any host with an unpatched Chrome plus local malware infections as potentially sandbox-escaped. Restrict untrusted local software execution and application whitelisting also reduce the practical attack path, since exploitation requires a local program.