CVE-2026-91748 is a race condition vulnerability in the Extensions subsystem of Google Chrome on Mac platforms before version 153.0.8010.47. An attacker who has already compromised the renderer process and employs social engineering techniques can exploit this flaw to execute arbitrary code outside the browser sandbox, increasing the impact of the initial compromise. The vulnerability has been assigned a CVSS v3.1 score of 8.3, indicating high severity, with attack vector network, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to arbitrary code execution outside the sandbox, potentially allowing an attacker to escalate privileges or perform unauthorized actions on the affected system. The vulnerability requires prior compromise of the renderer process and user interaction, limiting but not eliminating risk.

A fix is available in Google Chrome version 153.0.8010.47. Users and administrators should update affected Chrome installations on Mac to this version or later to remediate the vulnerability. No additional mitigation steps are indicated.