Loading vulnerability…
Sandboxed code execution in Google Chrome Compositing
CVE-2026-91731 is a high-severity type-confusion vulnerability in the Compositing component of Google Chrome before version 153.0.8010.47. A remote attacker can trigger the flaw through a crafted HTML page and execute arbitrary code within the browser sandbox. Chromium-based browsers incorporating the affected component are also affected. The specific vulnerable function and detailed exploitation mechanics are not publicly specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises code execution within the browser sandbox, potentially affecting the confidentiality, integrity, and availability of resources accessible to the compromised process. This vulnerability alone does not establish sandbox escape, operating-system privilege escalation, or unrestricted host compromise.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Until patched, restrict use of affected browsers for untrusted web content and limit exposure to untrusted websites and downloaded HTML. Browser hardening and least-privilege controls are defense-in-depth measures, not substitutes for updating.
Patch, then assume compromise.
Update Google Chrome to 153.0.8010.47 or later on Windows and Linux, and 153.0.8010.48 or later on macOS, then relaunch the browser. Update Microsoft Edge to 153.0.4234.46 or later. For Debian stable (trixie), install Chromium 153.0.8010.47-2~deb13u1 or later. For Fedora and EPEL, install the applicable distribution-provided Chromium 153.0.8010.52 security update or later and log out and back in as directed. Prisma Browser 153.3.4.48 fixes this CVE; version 155.16.5.40 or later covers the complete October security update. Verify that endpoints are running the patched browser rather than merely having downloaded an update.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.