CVE-2026-91744

A race condition (CWE-367) in the PlatformIntegration component of Google Chrome on macOS, versions prior to 153.0.8010.47, allows a remote attacker to obtain sensitive information. The flaw is triggered when a victim interacts with a crafted HTML page, but exploitation requires the attacker to have already compromised the browser's renderer process and to leverage social engineering, consistent with the High attack-complexity and user-interaction requirements in the CVSS vector. A successful attack compromises confidentiality but does not affect integrity or availability. Only Chrome builds on Mac earlier than 153.0.8010.47 are listed as affected. No public proof-of-concept is known and the issue is not on CISA's Known Exploited Vulnerabilities catalog, so no in-the-wild exploitation has been reported.

What to do: Update Chrome on macOS to version 153.0.8010.47 or later via Help > About Chrome (chrome://settings/help), which forces the update check. Enterprise administrators should verify that managed Mac fleets have pulled the patched version, since policy-controlled rollout can lag consumer auto-updates. Because exploitation requires a prior renderer compromise plus user interaction, confirming Site Isolation is enabled provides additional defense-in-depth.