Loading vulnerability…
Sandbox Escape in Google Chrome Extensions on macOS
CVE-2026-91727 is a high-severity incorrect reference-resolution vulnerability in the Extensions component of Google Chrome on macOS before version 153.0.8010.47. A local attacker who has already compromised a renderer process can exploit the flaw through a local program to execute arbitrary code outside the browser sandbox. The specific vulnerable function and reference-resolution mechanism have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation breaks the renderer sandbox security boundary, allowing arbitrary code execution outside its restrictions. This can compromise the confidentiality, integrity, and availability of resources accessible to the resulting execution context. The vulnerability does not, by itself, establish root or administrator privileges.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until patching is complete, limit use of affected browser installations and exposure to untrusted extensions, and investigate renderer-compromise alerts. These measures reduce exposure but do not correct the reference-resolution flaw.
Patch, then assume compromise.
Upgrade Google Chrome on macOS to version 153.0.8010.47 or a later patched stable release; version 153.0.8010.48 is also included in the macOS security rollout. Restart Chrome after installation and verify that the patched version is running. Related downstream updates list Microsoft Edge 153.0.4234.46 and Prisma Browser 153.3.4.48 as releases addressing this CVE.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.