CVE-2026-91748: 
vulnerability analysis and mitigation

CVE-2026-91748 is a race condition vulnerability in the Extensions component of Google Chrome on macOS that allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the Chrome sandbox via social engineering and UI interaction. It was reported to Google on June 9, 2026, and publicly disclosed on September 15, 2026, as part of the Chrome 153 stable channel update. The vulnerability affects Google Chrome versions prior to 153.0.8010.47 on Mac. It carries a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory, Chrome Releases).

The vulnerability is classified as a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) and a Context Switching Race Condition (CWE-368) within Chrome's Extensions subsystem on macOS. An attacker who has already compromised the renderer process can exploit a timing window in the Extensions component — where the state of a resource changes between when it is checked and when it is used — to escape the Chrome sandbox. Exploitation requires user interaction via social engineering (UI interaction), meaning the attacker must trick the victim into performing some browser action to trigger the race condition at the right moment. The Chromium issue tracker entry is #521559611, though full bug details remain restricted pending broad user uptake of the patch (GitHub Advisory, Chrome Releases).

Successful exploitation allows an attacker to execute arbitrary code outside the Chrome sandbox on macOS systems, effectively achieving a full sandbox escape with the privileges of the browser process. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system, including access to sensitive user data, installation of malware, and potential lateral movement within the victim's environment. The scope change (S:C in CVSS) reflects that the impact extends beyond the browser's security boundary to the underlying operating system (GitHub Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, indicating a very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a pre-compromised renderer process and user interaction via social engineering, which significantly raises the bar for attackers and reduces the likelihood of opportunistic exploitation.

Google has released a patch in Chrome version 153.0.8010.47 (Linux) and 153.0.8010.47/.48 (Windows and Mac), which addresses this vulnerability along with 41 other security fixes. Users and administrators should update Google Chrome to version 153.0.8010.47 or later immediately. In enterprise environments, consider implementing extension management policies to restrict installation of untrusted or unreviewed extensions, and educate users to be cautious of unexpected browser prompts or social engineering attempts (Chrome Releases).

The Chrome 153 update, which includes this fix, received coverage from several cybersecurity news outlets noting the breadth of the release — 42 security fixes including three critical vulnerabilities. Coverage highlighted the overall significance of the update rather than this specific CVE in isolation (cybersecuritynews.com, Cryptika). No notable individual researcher commentary or significant social media discussion specific to CVE-2026-91748 has been observed.