CVE-2026-91749: Google Chrome Web Workers Subsystem Use-After-Free Remote Code Execution

HERMES

HERMES THREAT SCORE & BROWSER RENDERER COMPROMISE

Target: Google Chrome Desktop & Android — Blink DedicatedWorker / Thread Lifecycle Manager

Confidence: 96%

89 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 18 / 20

Weaponization 18 / 20

Exposure 19 / 20

Prevalence 20 / 20

Impact 18 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 18 / 20

⚖️ Divergence & Operational Rationale

Rated CVSS 8.8 and HTS 89 (HIGH). Race conditions during web worker lifecycle termination allow attackers to retain dangling pointers in the renderer process. When visited by a victim, a malicious web page can groom the PartitionAlloc heap and execute arbitrary code inside the renderer.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-91749: Google Chrome Web Workers Subsystem Use-After-Free Remote Code ExecutionVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTGoogle Chromium / V8 Engine

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Google Chromium / V8 Engine documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Chrome Security Advisory: September 2026

CVSS v3.1: 8.8 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) / CWE-416: Use After Free. Affects Google Chrome desktop (Windows, macOS, Linux) and Android prior to version 153.0.8010.47.

Executive Summary

Disclosed in Google’s September 2026 security release, CVE-2026-91749 is a critical Use-After-Free vulnerability in the Web Workers implementation of the Chromium Blink rendering engine. When a web application rapidly terminates a DedicatedWorker or SharedWorker while asynchronous cross-thread message dispatching is in flight, the parent thread accesses a freed WorkerThread object. A remote attacker hosting a malicious webpage can groom the memory layout to execute arbitrary code within the renderer process.

---

1. Technical Context & Affected Software Matrix

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-91749	Google Chrome Stable Release Bulletin
Vulnerability Class	Use-After-Free (CWE-416)	Renderer process code execution
Affected Component	Blink Rendering Engine WorkerThread Lifecycle	Multi-threaded JavaScript runtime
Authentication Required	None (PR:N)	Client visits an untrusted website
User Interaction	Required (UI:R)	User navigation to malicious web page
Scope Impact	Unchanged (S:U)	Confined to browser renderer (requires sandbox escape chain)
Privileges Obtained	Renderer Process Context	Arbitrary memory corruption and execution
Affected Versions	Google Chrome Desktop & Android < 153.0.8010.47	All supported desktop and mobile platforms
Remediation Target	Google Chrome 153.0.8010.47	Update to latest stable release

---

2. Vulnerability Anatomy & Lifecycle Race

sequenceDiagram
    autonumber
    actor Victim as Web User
    participant Main as Blink Main Thread
    participant Worker as Worker Thread
    participant Heap as PartitionAlloc Heap

    Victim->>Main: Load malicious page with rapid worker spawn/terminate loop
    Main->>Worker: Spawn DedicatedWorker
    Main->>Worker: Dispatch async postMessage()
    Main->>Worker: Invoke worker.terminate()
    Worker->>Heap: WorkerThread object memory freed
    Main->>Heap: In-flight message callback accesses freed WorkerThread (UAF)
    Heap-->>Main: Execution redirected to attacker-controlled function pointer

---

3. Remediation, Patching & Hardening

1. T0 Immediate Action (< 24h) — Update Google Chrome: Update Google Chrome to version 153.0.8010.47 across Windows, macOS, Linux, and Android.
2. T1 Tactical Hardening (< 7d) — Ensure Site Isolation is Enabled: Verify enterprise policies enforce strict Site Isolation (--site-per-process) to contain any renderer compromises to origin boundaries.

---

4. Related Intelligence & Attack Paths

Google Chromium / V8 Intelligence Explore vulnerability trends, architecture details, and hardening guides for Chromium.

Chrome WebGL Buffer Overflow (CVE-2026-93372) Analyze the companion GPU sandbox escape vulnerability.

Private Stack Audit Audit your browser software deployments privately in your browser.