CVE-2026-91748

A race condition (CWE-367) in the Extensions subsystem of Google Chrome on macOS, fixed in version 153.0.8010.47, could allow a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation is a two-step chain: the attacker must first have compromised the renderer process (typically via a separate memory-corruption bug) and then use social engineering to trick the user into a specific UI interaction that triggers the timing window. Successful exploitation yields code execution with the user's privileges on the macOS host, escaping Chrome's sandbox protections. Only Chrome installations on macOS running versions prior to 153.0.8010.47 are affected. No public proof of concept is known, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

What to do: Update Google Chrome on macOS to version 153.0.8010.47 or later immediately; users can confirm they are patched at chrome://settings/help, and enterprises should enforce this minimum version via policy. Because exploitation requires a prior renderer compromise, defenders should ensure other Chromium renderer vulnerabilities are also patched promptly and treat any unsolicited browser UI prompts or dialogs as suspicious. Monitor for Chrome extension-related process anomalies on macOS endpoints until rollout is confirmed.