Google Chrome CVE-2026-91732

Not a default-config remote attack. Exploitation requires TWO stacked preconditions explicitly stated in the description: (1) the attacker must have already compromised Chrome's renderer process (typically via a separate prior vulnerability), and (2) social engineering to induce victim interaction (UI:R) with a crafted HTML page, in order to abuse the AppManifest missing-authorization check and bypass web-origin policy. Limiting factors: the renderer must be pre-compromised (this is a sandbox/origin-isolation weakness, not an initial-access vector), user interaction is mandatory, and the fix ships in Chrome 153.0.8010.47 so patched/auto-updated browsers are not affected.

CVSS 3.1 base is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), but that headline number materially overstates real-world risk and even conflicts with Google's own 'Chromium security severity: Medium' rating. The decisive detail sits in the description, not the vector: the attacker must ALREADY have 'compromised the renderer process' AND then chain social engineering (UI:R) to bypass web-origin policy. That renderer-compromise precondition is a heavy prerequisite the CVSS PR:N metric does not capture - Google conventionally scores browser-sandbox flaws with PR:N because a compromised renderer is not an 'account privilege', so the vector reads more open than the attack actually is. Corroborating signals point to low urgency: EPSS is 0.25% (16th percentile), the CVE is NOT in CISA KEV, and no public exploit is referenced. This is a defense-in-depth / origin-isolation weakness meaningful mainly as one link in a multi-stage sandbox-escape chain, not a standalone remotely-weaponizable bug. Net: high nominal CVSS, but low immediate priority given the required prior renderer compromise, added user interaction, absent exploitation evidence, and a patch already shipped.

An attacker who has already exploited a separate renderer-level bug (e.g., a V8 or DOM flaw giving code execution inside Chrome's sandboxed renderer) crafts a malicious HTML page and uses social engineering to get the victim to interact with it, abusing the AppManifest missing-authorization flaw to bypass web-origin policy and access resources across origins. No public proof-of-concept is referenced and the issue is not listed in CISA KEV, so this remains a theoretical chain link rather than an observed in-the-wild attack.