CVE-2026-91711 exposes an out-of-bounds write in the ServiceWorker component of Google Chrome. An attacker can craft a malicious HTML page that, when opened in a vulnerable browser, writes beyond memory bounds and gains the ability to execute arbitrary code within the browser's sandbox. This flaw provides a high‑severity remote code execution vector, as the attack does not require local privileges or user interaction beyond loading the page.

The vulnerability affects Google Chrome browsers with versions older than 153.0.8010.47. Any machine running the affected Chrome build is susceptible, regardless of operating system, as the flaw is in the browser's core service worker implementation.

The CVSS base score of 8.8 indicates a high severity for remote code execution. The EPSS score being less than 1% suggests that exploitation probability is low, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires network access to deliver the crafted HTML page to the target's browser, likely via a phishing link or malicious website. Once the page is rendered, the out-of-bounds write is triggered immediately, exposing the full attack surface of the sandboxed worker context.