googleCVE-2026-91723

Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Low3.1CVE-2026-91723 · Published Sep 15, 2026 · updated Sep 18, 2026

Affected versions

Package	Affected	Fixed in
Chrome Vendor	>= 153.0.8010.47, < 153.0.8010.47	153.0.8010.47

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity from: NVD
Weakness: CWE-362

More google advisories

All

Date	Advisory	Severity	Fixed in
Sep 15	In Cellular Modem, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. CVE-2026-0159High8.8no fix yet	High8.8	No fix yet
Sep 15	In Vp9DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. CVE-2026-0170High8.8no fix yet	High8.8	No fix yet
Sep 15	In multiple locations, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. CVE-2026-0171High8.8no fix yet	High8.8	No fix yet
Sep 15	In do_sss_aes_gcm_256_op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. CVE-2026-0177Medium4.4no fix yet	Medium4.4	No fix yet
Sep 15	In Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. CVE-2026-0179Medium6.7no fix yet	Medium6.7	No fix yet
Sep 15	In CPM, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with System execution privileges needed. CVE-2026-0183Medium4.4no fix yet	Medium4.4	No fix yet

Affected versions

More google advisories

Critical advisories by email