CVE-2026-91719 is a code injection flaw in XML handling in Google Chrome before 153.0.8010.47. A crafted web page could bypass the web origin policy. NVD scores it High (8.1), but Chromium rates its own severity Low. Update Chrome to 153.0.8010.47 or later.
What's affected
Google's stable channel release notes for 15 September 2026 list the fix in Chrome 153.0.8010.47 and .48 for Windows and Mac, and 153.0.8010.47 for Linux. The NVD record says Chrome before 153.0.8010.47.
The weakness is CWE-94, code injection. The record's vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.
The sources disagree on severity. NVD scores it 8.1 (High). The record's own description ends with the note that the Chromium security severity is Low, and Google's release notes list it under Low. Google credits the researcher in the release notes and says the update includes 42 security fixes, so it is worth taking in any case.
How to check if you're exposed
Open chrome://version in the browser and read the version string. Any version below 153.0.8010.47 is affected. You can also use the three-dot menu, then Help, then About Google Chrome, which also triggers an update check.
For managed fleets, use your endpoint management tool to list installed Chrome versions. Browsers based on Chromium, such as other vendors' builds, have their own release schedules, so check each vendor's notes rather than assuming the version number is the same.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Update Chrome to 153.0.8010.47 or later on all desktops, then restart the browser so the update applies.
- Check managed devices for browsers that have been open for a long time and have not restarted.
- Check other Chromium based browsers and embedded runtimes for their own updates.
- Keep automatic updates on.
Why it matters
Chromium assigns its own severity to each bug based on how it fits into the browser's security model, and for this issue the project's label is Low. NVD's score comes from a generic formula applied to the description, which treats a bypass of the origin policy as a high confidentiality and integrity impact. Both views are accurate in their own terms.
The origin policy is what keeps one site from reading another's data in your browser, so any bypass deserves attention even when the project judges it hard to use. The KEV flag in the record is false and the release notes do not mention exploitation of this bug.
Quick check
Why do the NVD score and Chromium rating differ so much?
NVD scored it 8.1 with its formula. Chromium's own label is Low. Both are in the sources, and the fix is the same.
Do I need to act on a Low severity Chrome bug?
Updating is routine and covers 42 security fixes in the same release, so yes.
Sources
Last reviewed: 18 October 2026.
