CVE-2026-91735 describes an incorrect authorization vulnerability in the WebUI of Google Chrome versions before 153.0.8010.47. An attacker who has already compromised the renderer process can exploit this flaw by crafting a malicious HTML page to execute arbitrary code outside the sandbox, thereby escalating privileges within the browser environment. The vulnerability is rated high severity with a CVSS 3.1 score of 8.3, indicating network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote code execution outside the sandbox, potentially leading to full compromise of the browser process and increased ability to affect the host system. The attacker must first compromise the renderer process and then leverage this vulnerability to escalate privileges beyond the sandbox restrictions.

A fix is available in Google Chrome version 153.0.8010.47. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigations are specified. Since this is not a cloud service, patching the client software is required.