CVE-2026-91732 Google CVE debrief

Who should care

Defenders responsible for Google Chrome deployments, incident response teams, and security teams should assess exposure and prioritize verification and updates. This includes teams responsible for managing Chrome installations, incident response, and security operations. They should review and update incident response plans to address potential bypass of web origin policy and monitor for potential social engineering attempts.

Why it matters

CVE-2026-91732 is a missing authorization vulnerability in Google Chrome's AppManifest that allows a remote attacker to bypass web origin policy via a crafted HTML page, potentially leading to unauthorized access to sensitive data. Defenders should prioritize verification and updates, and monitor for potential social engineering attempts.

• Verification of Google Chrome version and exposure to potential social engineering attempts
• Potential bypass of web origin policy, allowing unauthorized access to sensitive data
• Prioritization of updates and incident response planning to address potential vulnerability

Technical summary

The vulnerability is caused by missing authorization in Google Chrome's AppManifest prior to version 153.0.8010.47. A remote attacker who has compromised the renderer process and leveraged social engineering can bypass web origin policy via a crafted HTML page. The vulnerability has a medium severity rating and was reported by the chromium security team. Defenders should prioritize verifying and updating Google Chrome to version 153.0.8010.47 or later, and monitor for potential social engineering attempts. The CVE record and NVD entry provide details on the vulnerability, but further verification is needed to confirm affected versions and potential impact.

Defensive priority

Defenders should prioritize verifying and updating Google Chrome to version 153.0.8010.47 or later, and monitor for potential social engineering attempts.

Recommended defensive actions

• Verify and update Google Chrome to version 153.0.8010.47 or later
• Monitor for potential social engineering attempts
• Review and update incident response plans to address potential bypass of web origin policy
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was reported by chromium security team with a medium severity rating. The CVE record and NVD entry provide details on the vulnerability, but further verification is needed to confirm affected versions and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.