Loading vulnerability…
CSS Observable Discrepancy Information Disclosure in Google Chrome
CVE-2026-91725 is an observable-discrepancy vulnerability in the CSS component of Google Chrome before version 153.0.8010.47. A remote attacker can use a crafted HTML page to leak sensitive information through observable differences in CSS behavior. The vulnerability also affects Chromium-derived browsers. Chromium classifies the issue as Medium severity. The affected function, precise discrepancy, and categories of exposed information have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose sensitive information. The CVE-specific CVSS v3.0 assessment assigns high confidentiality impact and no integrity or availability impact, with vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. Arbitrary code execution, privilege escalation, and denial of service are not established impacts of this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until patched, restrict use of affected browsers for untrusted web content and apply organizational browser-management and isolation controls to reduce exposure. These measures do not replace installing the security update.
Patch, then assume compromise.
Update Google Chrome to 153.0.8010.47 or later on Windows and Linux, and 153.0.8010.48 or later on macOS. Update Microsoft Edge to 153.0.4234.46 or later. For Debian 13 (trixie), update Chromium to 153.0.8010.47-2~deb13u1 or later. Fedora and EPEL users should install the applicable distribution-provided Chromium 153.0.8010.52 security update or a later fixed build. Prisma Browser 153.3.4.48 includes the fix for this CVE; version 155.16.5.40 or later addresses the complete October advisory. Relaunch the browser after updating and verify that the patched version is active; Fedora guidance additionally specifies logging out and back in.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.