CVE-2026-91732 is a missing authorization vulnerability in the AppManifest feature of Google Chrome versions before 153.0.8010.47. This flaw enables a remote attacker, who has already compromised the renderer process and employs social engineering techniques, to bypass the web origin policy by using a specially crafted HTML page. This could potentially allow unauthorized access or actions that violate the intended security boundaries enforced by the web origin policy.

The vulnerability allows bypassing of the web origin policy, which is a fundamental security control in browsers to isolate content from different origins. This could lead to unauthorized access to web resources or data that should be restricted by origin boundaries. However, exploitation requires prior compromise of the renderer process and social engineering, limiting the attack surface and impact scope. The Chromium security team rates this vulnerability as medium severity.

A fixed version of Google Chrome is available. Users should update to version 153.0.8010.47 or later to remediate this vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html for details and update instructions.