Loading vulnerability…
UI Spoofing in Chrome Transactions Platform
CVE-2026-91739 is a missing-authorization vulnerability in the Transactions Platform component of Google Chrome before version 153.0.8010.47. A remote attacker who has already compromised a renderer process can use a crafted HTML page to spoof user-interface elements. Chromium classifies the vulnerability as Medium severity. The flaw also affects Chromium-based browsers that have not incorporated the corresponding fix.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows spoofing of user-interface elements, potentially misleading users about the authenticity of browser or transaction interfaces. This vulnerability does not itself establish initial renderer compromise, arbitrary code execution, or privilege escalation.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Until updates are deployed, restrict exposure to untrusted web content, apply browser hardening, and maintain endpoint protections that detect renderer exploitation or anomalous browser behavior. These measures reduce exposure but do not correct the missing authorization check.
Patch, then assume compromise.
Update Chrome to 153.0.8010.47 or later on Windows and Linux, or 153.0.8010.48 or later on macOS, and restart the browser. Update affected Microsoft Edge installations to 153.0.4234.46 or later. For Prisma Browser, the CVE-specific fix is included in 153.3.4.48; version 155.16.5.40 or later addresses the complete October advisory. For distribution-managed Chromium, install the applicable vendor update: Debian stable fixes the issue in 153.0.8010.47-2~deb13u1, and the listed Fedora/EPEL updates provide platform-specific builds of 153.0.8010.52.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.