Description
Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-09-15
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in Google Chrome’s WebUI authorization allows a remote attacker who has already compromised the renderer process to craft an HTML page that may execute arbitrary code outside the sandbox. The vulnerability was rated with a CVSS score of 8.3, indicating a high‑impact problem that can lead to full system compromise if successful.

Affected Systems

Google Chrome browser prior to version 153.0.8010.47 is affected. The issue exists in all desktop builds of Chrome with the vulnerable WebUI implementation.

Risk and Exploitability

The EPSS score is below 1%, suggesting that exploitation probability is low, and the vulnerability is not currently listed in CISA KEV. In practice the attacker would need to serve malicious content that gains control of the renderer process and then exploit the weakened authorization in the WebUI to escape the sandbox. If successful, the attacker could run code with local user privileges or potentially higher, depending on the sandbox configuration.

Generated by OpenCVE AI on September 16, 2026 at 19:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 153.0.8010.47 or later, which contains the WebUI authorization fix.
  • Configure Chrome administrative policies to enforce strong sandboxing for renderer processes and limit WebUI access; block abnormal renderer activity logs, and disable or isolate any extensions that interact with the WebUI if the issue persists.
  • Enable automatic updates for Chrome and set the update channel to stable or rapid so that the fix is applied promptly.
  • Review and remove unnecessary extensions that interact with the WebUI to reduce the attack surface.

Generated by OpenCVE AI on September 16, 2026 at 19:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 16 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Title Chrome WebUI Authorization Flaw Enabling Remote Code Execution

Wed, 16 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 15 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-863
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-17T03:56:16.584Z

Reserved: 2026-09-14T22:52:31.449Z

Link: CVE-2026-91735

cve-icon Vulnrichment

Updated: 2026-09-15T23:46:00.819Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T21:16:47.020

Modified: 2026-09-17T16:03:04.173

Link: CVE-2026-91735

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T19:30:06Z

Weaknesses