CVE-2026-91713 is a vulnerability in Google Chrome's browser component where missing authorization checks allow a remote attacker with control over the renderer process to spoof UI elements by delivering a crafted HTML page. This flaw affects Chrome versions before 153.0.8010.47 and was assigned a medium severity level by Chromium security. The vulnerability could enable UI spoofing but requires prior compromise of the renderer process.

An attacker who has already compromised the renderer process can exploit this vulnerability to spoof UI elements, potentially misleading users about the origin or nature of displayed content. This could facilitate phishing or social engineering attacks within the browser context. However, exploitation requires prior control over the renderer process, limiting the scope of impact.

This vulnerability is fixed in Google Chrome version 153.0.8010.47. Users and administrators should update to this version or later to remediate the issue. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html for details.