Chrome PDF flaw CVE-2026-91737 runs code in the sandbox, PoC public

What happened

Google released Chrome stable 153.0.8010.47 on 15 September 2026. The update fixes 42 security issues. One is CVE-2026-91737, a use-after-free in Chrome's PDF component.

A crafted HTML page can trigger the bug. The result is code execution inside Chrome's renderer sandbox. The reporters, SeungMyung Lee (@sm1ee) and Siung kim (@ksw9722), found it on 6 September 2026.

On 12 October 2026, Lee published a GitHub repository claiming a PoC for the CVE. That is four weeks after the fix shipped.

Who is affected

Chrome on Windows, macOS and Linux before 153.0.8010.47 is affected. Windows and macOS builds are 153.0.8010.47 or .48. Other Chromium-based browsers can share the flaw until they ship the upstream fix. ThreatWire did not check Edge, Brave or other vendors.

Enterprises that delay browser restarts are most exposed. Chrome applies the update only after a relaunch.

What is confirmed

The Chrome Releases post lists the flaw as High severity. NVD shows CVSS 3.1 8.8 from the CISA ADP entry. Google did not publish its own score. The weakness is CWE-416.

Execution is limited to the renderer sandbox. The sandbox is designed to stop a compromised page from reaching the rest of the system. Full compromise would need a second bug to escape it. Neither Google nor the reporter claims such a chain here.

Google lists the reporter bounty as TBD. The CVE is not in the CISA KEV catalog. CISA's SSVC entry on NVD records exploitation as none.

The reporter's repository claims a renderer code execution PoC for this CVE. The account belongs to the credited reporter. ThreatWire did not run or verify the PoC.

What is not confirmed

Google does not report exploitation in the wild for this bug. ThreatWire could not confirm that the PoC works as described. It also cannot say whether other Chromium browsers have shipped fixes.

ThreatWire found one established outlet, SecurityWeek, covering the 153.0.8010.47 update. That coverage does not single out this CVE. The bounty amount is still open.

What to do

Update Chrome to 153.0.8010.47 or later, then restart the browser. Check chrome://settings/help to see the running version. Managed fleets should push the update and enforce relaunch.

Update other Chromium-based browsers when vendors publish fixed builds. Public PoC code can speed up exploit development, so do not wait. Browser exploits normally need a sandbox escape, so prompt patching of the other fixed bugs matters too.

Sources: the Chrome Releases blog, NVD, CVE.org, SUSE and SecurityWeek. Links are in the references list.