CVE-2026-91747: Use After Free

Q: What access does an attacker need to exploit this issue?

The attacker must first have compromised the Chrome renderer process. They can then use a crafted HTML page to obtain cross-origin data.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.47 are affected.

Q: What is the security impact after successful exploitation?

Successful exploitation can allow a remote attacker with a compromised renderer process to access cross-origin data.

Published Sep 15, 2026

Updated

Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Skia<153.0.8010.47

Event History

Sep 15, 2026

CVE Published

via MITRE·08:41 PM

Data Sourced

via MITRE·08:41 PM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must first have compromised the Chrome renderer process. They can then use a crafted HTML page to obtain cross-origin data.

Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.47 are affected.

What is the security impact after successful exploitation?

Successful exploitation can allow a remote attacker with a compromised renderer process to access cross-origin data.