CVE-2026-91749

CVE-2026-91749 is a critical-severity use-after-free vulnerability (CWE-416) in the Workers component of Google Chrome, fixed in version 153.0.8010.47. A remote attacker triggers the flaw by luring a victim to a crafted HTML page, where a freed memory object in the Worker implementation is improperly reused, potentially allowing arbitrary code execution outside the browser sandbox. Successful exploitation means a malicious webpage can escape Chrome's sandbox and run code on the underlying operating system with the user's privileges, effectively fully compromising the workstation. All Chrome installations prior to 153.0.8010.47 are affected on every platform, and third-party Chromium-based browsers inherit the vulnerable engine code until they ship the upstream fix. No public proof-of-concept is known and the bug is not on CISA's Known Exploited Vulnerabilities catalog, but the Critical severity rating indicates Google judged the potential impact to be severe.

What to do: Update Google Chrome to version 153.0.8010.47 or later immediately and verify via chrome://settings/help; enterprises should confirm update policies have applied the fix fleet-wide. Because exploitation requires only that a victim visit a crafted page, defenders should monitor EDR telemetry for renderer/worker-process crashes or unexpected child processes spawned by Chrome until the fleet is fully patched. Administrators of Chromium-based browsers that bundle the same engine (e.g., Edge, Brave, Vivaldi, Opera) should deploy those vendors' equivalent updates as soon as they are released.