CVE-2026-91749

No known exploitation. EPSS puts it in the 24th percentile. A vendor fix is available.

CVSS 3.19.6Critical EPSS percentile24th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-15Updated 2026-09-24Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check the Chrome version on company computers: open Chrome’s menu, choose Help, then About Google Chrome.
Update Google Chrome to 153.0.8010.47 or later, then restart the browser when prompted.
Ask staff to close unexpected webpages and report suspicious links until all work devices are updated.

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

In plain language

Written by AI from the record

Google Chrome before 153.0.8010.47 has a serious flaw: a malicious webpage can break out of Chrome’s protections after someone opens it, so small businesses should update Chrome now.

Critical use-after-free in Chrome Web Workers enables potential sandbox escape and arbitrary code execution through crafted HTML after user interaction.

If you're affected

Device takeover risk
Business data exposure
Ransomware risk
Work disruption

What is it

This is a mistake in how Chrome handles a background part of a webpage. A malicious page could use it like slipping through a locked office’s back door, potentially getting past Chrome’s normal protective barrier and running unwanted code on the computer.

Who is affected

This matters to you if employees or business devices use Google Chrome. It is especially relevant for computers that open links, visit websites, or use web-based business tools; the attack requires someone to open a malicious webpage.

How urgent is it

An attacker can use a crafted webpage to try to run code beyond Chrome’s normal safety barrier after a user opens it. Treat this as urgent because the flaw is rated critical and has a straightforward web-delivery path, although there is no confirmed report of active attacks.

What to do — in detail

Confirm exposure by inventorying Chrome installations and checking their installed version through Chrome’s About page or your device-management tool. Upgrade all affected installations to Google Chrome 153.0.8010.47 or later; no branch-specific alternative fix is provided in the findings. The normal Chrome update path should apply, but test any managed browser policies or business web applications in a small group first if your organization controls updates centrally. If patching is delayed, reduce exposure by preventing use of Chrome on untrusted sites, restricting link-opening from email and chat where practical, and using an alternate approved browser only if it is current. CVE-2026-91749 is not listed in CISA KEV, so no CISA remediation due date is provided. Watch browser-management reports for devices that remain below the fixed version and investigate reports of unexpected downloads, browser crashes, or unfamiliar software launches after suspicious webpage visits.

Technical context

CVE-2026-91749 is CVSS 9.6 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). It is CWE-416, a use-after-free in Web Workers, reachable through a network-delivered crafted HTML page; no authentication is required, but user interaction is required. The reported capability is potential arbitrary code execution outside the Chrome sandbox. CISA KEV does not list the CVE, news provides no clear dated claim of exploitation in the wild, and no public exploit code is recorded. EPSS is 0.3% (27th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 9 days, from the signal feeds we watch.

2026-09-24Patch availablerecord updated
2026-09-17Record updated
2026-09-16Record updatedrecord updated
2026-09-15Publishedweakness classified, att&ck mapped, record updated

Affected products

Googlecommercial · USaka google inc, google llc
- ChromeDesktop AppOn-premConsumer Software / browser

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Scored 9.6 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable