Loading vulnerability…
Cross-origin data disclosure through a race condition in Chromium Network
CVE-2026-91708 is a high-severity race condition in the Network component of Google Chrome before version 153.0.8010.47 and affected Chromium-based browsers. A remote attacker who has already compromised a renderer process can use a crafted HTML page to obtain cross-origin data, bypassing browser origin-based isolation. The specific vulnerable function and synchronization failure have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exposes cross-origin data to an attacker controlling a compromised renderer process, violating browser confidentiality boundaries. The vulnerability-specific CVSS v3 assessment indicates low confidentiality impact and no integrity or availability impact. This vulnerability does not independently establish initial renderer compromise or arbitrary code execution.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until patched, restrict affected browsers' exposure to untrusted web content and use browser isolation controls where available. These measures reduce exposure but do not eliminate the race condition or replace updating.
Patch, then assume compromise.
Update Google Chrome to 153.0.8010.47 or later; the platform-specific release guidance specifies 153.0.8010.48 or later for macOS. Update Microsoft Edge to 153.0.4234.46 or later. For Debian stable (trixie), install Chromium 153.0.8010.47-2~deb13u1 or later. For affected Fedora and EPEL installations, install the applicable vendor-provided Chromium 153.0.8010.52 package or later. Prisma Browser includes this CVE's fix in 153.3.4.48; version 155.16.5.40 or later addresses the complete October Chromium security advisory. Relaunch the browser after updating and verify the running version; Fedora package guidance additionally calls for logging out and back in.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.