CVE-2026-91734
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Incorrect authorization in the Core component of Google Chrome on Windows prior to 153.0.8010.47. A local attacker can execute arbitrary code outside the sandbox via a local program.
Risk Assessment
An attacker with local access to the machine could execute code outside the browser sandbox, potentially leading to privilege escalation and system compromise.
Recommendation
Update Google Chrome to version 153.0.8010.47 or later on all Windows workstations.
Other vulnerabilities in Google Chrome
See all- CVE-2026-120930Unknown
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium rates this as High severity.
- CVE-2026-121257Unknown
Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
- CVE-2026-121256High
Use of a released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
- CVE-2026-121255Unknown
Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.
- CVE-2026-121254Unknown
Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.
- CVE-2026-121253Unknown
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension.
- CVE-2026-121252Unknown
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.
- CVE-2026-121251Unknown
Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.
- CVE-2026-121250Unknown
Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension.
- CVE-2026-121248Unknown
Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension.
Original NVD description (English source)
Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS