Executive brief
Google Chrome's network handling code contains a race condition that could allow an attacker who has already compromised the browser's rendering engine to steal data from other websites. The vulnerability requires an existing compromise and a specially crafted webpage to exploit, potentially exposing sensitive information from cross-origin sources.
Technical details
A race condition exists in Chrome's Network component prior to version 153.0.8010.47. The vulnerability requires an attacker to have already compromised the renderer process, then deliver a crafted HTML page to trigger the race condition and read cross-origin data that should be protected by browser isolation policies. The attack vector is network-based and requires both renderer process compromise and user interaction with a malicious page. Google patched this issue in Chrome 153.0.8010.47 released on September 15, 2026.
Affected products
- Google Chrome prior to 153.0.8010.47
Timeline
- 2026-09-15: disclosed: CVE-2026-91708 disclosed in Chrome 153.0.8010.47 stable release
- 2026-09-15: patched: Fixed in Chrome 153.0.8010.47 for Windows, Mac, and Linux