Description
Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Published: 2026-09-15
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑origin data leakage
Action: Patch Immediately
AI Analysis

Impact

Integer overflow in the Compositing component of Google Chrome allows a crafted web page to read memory belonging to another origin. The flaw can enable an attacker to obtain data that is protected by the same‑origin policy, effectively bypassing cross‑origin restrictions. This vulnerability is classified as a logic flaw leading to confidentiality loss.

Affected Systems

Google Chrome versions earlier than 153.0.8010.47 on desktop platforms are affected. The issue originates from the Chromium project and is limited to browsers built from Chromium releases before the specified version.

Risk and Exploitability

The CVSS score of 4.3 places the issue in the low to moderate range. EPSS indicates less than 1% likelihood of exploitation, and it is not listed in CISA’s KEV catalog. The attack requires an attacker to host a malicious HTML page that the victim loads. While technical barriers are present, the presence of the overflow provides a straightforward path once the page is visited.

Generated by OpenCVE AI on September 16, 2026 at 18:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 153.0.8010.47 or later.
  • Thereafter, enable automatic updates so that future patches are applied without manual intervention.
  • If immediate update is not possible, isolate your browsing activity by using a separate profile or virtual machine that restricts access to local files and disables JavaScript for untrusted content.

Generated by OpenCVE AI on September 16, 2026 at 18:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Integer overflow in Compositing
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 16 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 15 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-190
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-15T23:48:08.646Z

Reserved: 2026-09-14T22:53:01.147Z

Link: CVE-2026-91746

cve-icon Vulnrichment

Updated: 2026-09-15T23:48:05.294Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T21:16:48.440

Modified: 2026-09-16T19:15:47.623

Link: CVE-2026-91746

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-15T20:41:32Z

Links: CVE-2026-91746 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T18:45:10Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound