Google Chrome CVE-2026-91718

Exploitation requires the victim to load attacker-controlled content in Chrome versions prior to 153.0.8010.47 - the crafted HTML page (UI:R) is the mandatory trigger; there is no default-configuration remote-server exposure. No authentication, no special Chrome feature flag, and no non-default setting are needed beyond rendering the malicious page in a vulnerable build. The limiting factors are: user interaction (must visit/render the page) and being on an unpatched version; the flaw achieves code execution OUTSIDE the sandbox, so it is not contained by Chrome's normal renderer isolation.

This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) describes a network-reachable, low-complexity, unauthenticated use-after-free (CWE-416) that yields arbitrary code execution OUTSIDE the Chrome sandbox - the scope change (S:C) correctly reflects that the attacker breaks out of the renderer's sandbox to affect the underlying host, which is the most severe class of browser flaw. The only meaningful limiter is UI:R: the victim must visit an attacker-controlled or compromised page. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied data, so this is not confirmed as actively exploited - no public exploit identified at time of analysis. Google rates the Chromium severity 'High' and a patched Stable-channel build (153.0.8010.47) is already available. The absence of EPSS/KEV signals does not lower the intrinsic risk: browser sandbox escapes are historically among the most rapidly weaponized bugs once details or the patch are diffed, and Chrome's ubiquity makes it a broad target. Treat as urgent-patch despite the lack of exploitation telemetry.

An attacker hosts a malicious web page (or injects a crafted HTML payload into a compromised/ad-served page) that triggers the use-after-free in Chrome's Core component. When a victim simply visits the page, the freed-object reuse is manipulated to corrupt memory and execute attacker-controlled code outside the browser sandbox. No public proof-of-concept is present in the supplied data; exploitation still requires user interaction (visiting the page) but no authentication.