What is the CVSS score of CVE-2026-91741?

CVE-2026-91741 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Which versions of Google are affected by CVE-2026-91741?

Google Chrome versions older than 153.0.8010.47 contain a type confusion flaw in the CacheStorage component that allows any remote attacker to run malicious code inside the browser's renderer process…. A patch is available.

How to fix or mitigate CVE-2026-91741?

Within 24 hours, confirm the installed Chrome build on all managed endpoints and prioritize updating any host running a version below 153.0.8010.47 to the vendor-released 153.0.8010.47 (or later) via the standard update channel; verify auto-update is enabled and force a relaunch of the browser so the patched binary is actually running. Within 7 days, inventory Chrome-family and Chromium-embedded deployments - including Chrome on macOS/Linux, managed mobile clients, and any third-party applications bundling an embedded Chromium runtime - and ensure each is on a build at or above 153.0.8010.47 or has a documented vendor-supplied fix path; report completion rates to security management. Within 30 days, add browser version compliance to continuous asset and vulnerability reporting with alerting on builds below the fixed version, and pressure vendors of embedded-Chromium products that have not shipped 153.0.8010.47 or later to provide a patched release.

Google CVE-2026-91741

EUVD-2026-79969 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-09-15 chrome-cve-admin@google.com

GHSA-9q2q-wv9m-h4rp

RCE Google Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (google) · only source for this CVE.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 00:23 vuln.today

CVSS changed

Sep 16, 2026 - 00:22 NVD

8.8 (HIGH)

CVE Published

Sep 15, 2026 - 21:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 15, 2026 - 21:16 cve.org

HIGH 8.8

DescriptionCVE.org

Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Type confusion in Chrome's CacheStorage implementation in builds prior to 153.0.8010.47 lets a remote, unauthenticated attacker execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page. The bug is rated High by Chromium and 8.8 by NVD (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but it is a renderer-level compromise rather than a sandbox escape, so host impact requires chaining a second vulnerability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, confirm the installed Chrome build on all managed endpoints and prioritize updating any host running a version below 153.0.8010.47 to the vendor-released 153.0.8010.47 (or later) via the standard update channel; verify auto-update is enabled and force a relaunch of the browser so the patched binary is actually running. …

Threat intelligence, references, and detailed analysis are available after sign-in.