Executive brief
Google Chrome is a web browser used by billions of people to access websites and web applications. A flaw in Chrome's ServiceWorker implementation allows attackers to run malicious code within the browser sandbox by tricking users into visiting a crafted webpage. Successful exploitation could enable attackers to steal data, install malware, or compromise the user's system.
Technical details
A type confusion vulnerability exists in Google Chrome's ServiceWorker component (versions prior to 153.0.8010.47). The vulnerability is triggered when processing a crafted HTML page, allowing a remote attacker to execute arbitrary code within the browser's sandbox isolation layer. The attack requires user interaction (visiting a malicious webpage) but does not require authentication or special privileges. The vulnerability was patched in Chrome version 153.0.8010.47 and later. Chromium project classified this as High severity.
Affected products
- Google Chrome prior to 153.0.8010.47
Timeline
- 2026-09-15: disclosed: CVE-2026-91715 published
- 2026-09-15: patched: Chrome 153.0.8010.47 released with fix