CVE-2026-91731: Google Chrome vulnerability

Q: What must an attacker do to exploit this issue?

The attacker must cause Chrome to process a crafted HTML page, making this a remote, web-content-driven attack vector.

Q: Is this vulnerability fixed in current Chrome releases?

Chrome versions prior to 153.0.8010.47 are affected. Updating to version 153.0.8010.47 or later addresses the issue.

Q: What is the security impact if exploitation succeeds?

Successful exploitation can allow arbitrary code execution inside the Chrome sandbox. The provided information does not indicate that sandbox escape or host-level code execution is possible.

Published Sep 15, 2026

Updated

Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Chrome<153.0.8010.47

Event History

Sep 15, 2026

CVE Published

via MITRE·08:41 PM

Data Sourced

via MITRE·08:41 PM

DescriptionWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must cause Chrome to process a crafted HTML page, making this a remote, web-content-driven attack vector.

Is this vulnerability fixed in current Chrome releases?

Chrome versions prior to 153.0.8010.47 are affected. Updating to version 153.0.8010.47 or later addresses the issue.

What is the security impact if exploitation succeeds?

Successful exploitation can allow arbitrary code execution inside the Chrome sandbox. The provided information does not indicate that sandbox escape or host-level code execution is possible.