CVE-2026-91736

CVE-2026-91736 is a use-after-free flaw (CWE-416) in the Document Object Model (DOM) implementation of Google Chrome, fixed in version 153.0.8010.47. A remote attacker can trigger the flaw by convincing a victim to load a crafted HTML page, which causes the renderer to access freed memory, resulting in heap corruption and execution of arbitrary code inside the Chrome sandbox. Successful exploitation gives the attacker code execution in the context of the compromised renderer process with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8), though the code runs inside the sandbox rather than at full OS privileges unless chained with a separate sandbox escape. All users running Chrome versions prior to 153.0.8010.47 are affected. No public proof of concept exists, the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

What to do: Update Google Chrome to version 153.0.8010.47 or later immediately; because updates apply only on relaunch, users should check chrome://settings/help and fully restart the browser. Enterprise administrators should verify fleet-wide patch status via their browser management console (e.g., Google Admin console or WSUS-managed Chrome updates) and force relaunch policies to eliminate lingering unpatched sessions. Since exploitation requires only that a user visit a malicious page, sites that serve suspicious or user-submitted HTML content deserve heightened scrutiny until patch coverage is confirmed.