CVE-2026-91740: Google Chrome vulnerability

Q: What does an attacker need to exploit this issue?

The issue can be triggered remotely using a crafted HTML page. The available information does not state that authentication, local access, or user interaction beyond reaching the page is required.

Q: What information could be exposed if exploitation succeeds?

Successful exploitation may allow an attacker to obtain cross-origin data. The available information does not identify specific data types or affected web origins.

Q: Which Chrome versions should be remediated?

Google Chrome versions prior to 153.0.8010.47 are affected. Update Chrome to 153.0.8010.47 or later.

Published Sep 15, 2026

Updated

Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Chrome<153.0.8010.47

Event History

Sep 15, 2026

CVE Published

via MITRE·08:41 PM

Data Sourced

via MITRE·08:41 PM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The issue can be triggered remotely using a crafted HTML page. The available information does not state that authentication, local access, or user interaction beyond reaching the page is required.

What information could be exposed if exploitation succeeds?

Successful exploitation may allow an attacker to obtain cross-origin data. The available information does not identify specific data types or affected web origins.

Which Chrome versions should be remediated?

Google Chrome versions prior to 153.0.8010.47 are affected. Update Chrome to 153.0.8010.47 or later.