CVE-2026-91730 is an incomplete cleanup vulnerability in the GetUserMedia component of Google Chrome before version 153.0.8010.47. An attacker who has already compromised the renderer process and employs social engineering techniques can exploit this flaw to access cross-origin data through a specially crafted HTML page. This vulnerability was rated medium severity by Chromium security. The vendor has released an update to address this issue in Chrome 153.0.8010.47.

The vulnerability allows a remote attacker with control over the renderer process and the use of social engineering to bypass cross-origin data restrictions, potentially leading to unauthorized access to sensitive information from other origins within the browser context. This could compromise user privacy and data confidentiality.

Users and administrators should update Google Chrome to version 153.0.8010.47 or later, where this vulnerability has been fixed. The vendor advisory confirms the availability of an official fix. No additional mitigation steps are indicated beyond applying the update.