CVE-2026-91747

CVE-2026-91747 is a use-after-free vulnerability in Skia, the graphics rendering library used by Google Chrome, fixed in version 153.0.8010.47. It is a second-stage flaw: a remote attacker must first have compromised the renderer process (typically via a separate bug), then trigger the use-after-free through a crafted HTML page to break out of renderer sandbox restrictions and read cross-origin data, bypassing the same-origin policy. Google rates the Chromium severity as High because such renderer-to-browser primitives are valuable components of full exploit chains, though the CVSS base score is low (3.1) since exploitation requires prior renderer compromise and user interaction. All users of Chrome versions prior to 153.0.8010.47 are affected, and other Chromium-based browsers that bundle Skia likely inherit the flaw until their vendors ship the fix. There is no known public proof of concept and no evidence of in-the-wild exploitation; the issue is not on the CISA Known Exploited Vulnerabilities list.

What to do: Update Chrome to 153.0.8010.47 or later immediately (Help > About Chrome / chrome://settings/help); enterprises should push the update via Group Policy or their management console and verify fleet-wide versions. Users of Chromium derivatives such as Edge, Brave, Opera, and Vivaldi should apply their vendors' updates as soon as available, since they bundle the same Skia code. Because this bug requires the renderer to already be compromised, keeping the browser fully patched also closes the first-stage bugs an attacker would need to chain with it.