External risk intelligence

Chrome Integer Overflow Allows Sandbox Escape via Malicious HTML

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-91728

This vulnerability exists in a web browser, which is an internet-facing client application designed to process arbitrary, untrusted HTML content from the public internet by design.

Integer Overflow

Google Chrome

before 153.0.8010.47

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An integer overflow vulnerability in Google Chrome's V8 engine allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a malicious webpage. This could have significant implications for user data and system integrity.

Browser code execution via crafted web pages.
Impacts user data and system security.
Confirm relevance and exposure; prioritize user protection.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious website, which then triggers a vulnerability in the browser's JavaScript engine. This could allow them to execute their own code and potentially take control of the affected system.

Requires visiting a malicious page.
Crafted HTML triggers integer overflow.
Arbitrary code execution within sandbox.

Live Threat

Current exploitation, exposure, and threat context

An integer overflow vulnerability in V8, the JavaScript engine used by Chrome, could allow a remote attacker to execute arbitrary code within the browser's sandbox. This could occur when a user visits a specially crafted HTML page.

Arbitrary code execution within the sandbox.
Via a malicious HTML page.
Compromise of user session data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome's V8 engine requires immediate attention from teams responsible for endpoint security and browser management. The first practical step is to inventory all Chrome installations, confirm exposure via network access or user interaction, and identify accountable owners for affected systems. Planning remediation should be risk-based, prioritizing critical assets and user groups.

Browser and endpoint security teams own the issue.
Verify Chrome browser exposure and critical systems.
Plan and coordinate Chrome updates promptly.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome and the V8 engine?

Google Chrome is a widely used web browser that relies on the V8 engine to process and execute JavaScript. V8 is the component responsible for making web pages interactive by translating complex code into actions your browser can perform, essentially serving as the engine under the hood of your web browsing experience.

What does integer overflow mean in CVE-2026-91728?

An integer overflow is a weakness (CWE-190) where a program tries to store a number too large for its assigned memory space. In this CVE, the browser's JavaScript engine miscalculates data, which a clever attacker can exploit to bypass internal security boundaries and run unauthorized code on your system.

How does an attacker trigger this vulnerability?

An attacker triggers this by enticing a user to navigate to a specifically crafted HTML page. Simply having Chrome installed is not enough to be compromised; the vulnerability requires the active processing of malicious web content. Normal, benign website traffic does not trigger this flaw.

Is my system at risk?

According to Halo Surface Signal, this vulnerability is classified as likely to be relevant because browsers are designed to fetch and render content from the internet. Because you use Chrome to interact with public websites, your browser is inherently exposed to the risk of encountering malicious code intended to exploit such flaws.

Do I need to update my software?

Yes. The first step is to ensure all Chrome instances are updated to version 153.0.8010.47 or later. You should inventory your systems to identify outdated versions and prioritize updating machines that handle sensitive data or are used by high-risk groups to mitigate the risk of arbitrary code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.