CVE-2026-91747: 
vulnerability analysis and mitigation

CVE-2026-91747 is a use-after-free vulnerability in the Skia graphics library within Google Chrome that allows a remote attacker who has already compromised the renderer process to obtain cross-origin data via a crafted HTML page. It affects all versions of Google Chrome prior to 153.0.8010.47 and was reported to Google on 2026-07-28, with a patch released on 2026-09-15. The vulnerability carries a CVSS v3.1 base score of 3.1 (Low), reflecting the high attack complexity and limited confidentiality impact (Chrome Release, GitHub Advisory).

The root cause is a use-after-free condition (CWE-416, CWE-825) in Chrome's Skia graphics rendering library, where memory is accessed after it has been freed, potentially allowing an attacker to read memory contents belonging to a different security origin. Exploitation requires the attacker to have already compromised the Chrome renderer process — a significant precondition — and then deliver a specially crafted HTML page to trigger the freed memory access and leak cross-origin data. The bug was tracked internally as Chromium issue #540016074 and was discovered and reported by Google's own security team (Chrome Release, GitHub Advisory).

Successful exploitation results in a limited confidentiality breach: an attacker with an already-compromised renderer process can read cross-origin data that would otherwise be protected by the browser's same-origin policy. There is no impact on integrity or availability. The practical risk is constrained by the requirement for a pre-existing renderer compromise, making this vulnerability most relevant as a second-stage exploit in a chained attack scenario rather than a standalone threat (GitHub Advisory, Chrome Release).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the high attack complexity and the prerequisite of a compromised renderer process, making opportunistic exploitation unlikely without a chained exploit.

Google has released a patch in Chrome 153.0.8010.47 (Linux) and 153.0.8010.47/.48 (Windows and Mac), which addresses this vulnerability along with 41 other security fixes. Users and administrators should update Google Chrome to version 153.0.8010.47 or later as soon as possible. No configuration-based workaround is available; updating to the patched version is the only recommended remediation (Chrome Release).

The Chrome 153 update, which includes this fix, received coverage from several cybersecurity news outlets noting the breadth of the release — 42 security fixes including three critical vulnerabilities. Coverage highlighted the overall update rather than this specific CVE, given its lower CVSS score relative to the critical issues in the same release (cybersecuritynews).