CVE-2026-93374

CVE-2026-93374 is a use-after-free memory-corruption flaw in Dawn, the WebGPU component of Google Chrome, affecting Chrome on Android prior to version 153.0.8010.52. An attacker can trigger it remotely by convincing a user to open a specially crafted HTML page. Successful exploitation could allow arbitrary code execution outside the browser's security sandbox, which is a severe outcome because it escapes Chrome's core containment mechanism. All users of Chrome for Android on unpatched versions are affected; Google rates the flaw Critical and shipped the fix in Chrome 153, which patched 16 vulnerabilities including two critical ones. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the issue is not yet on CISA's KEV list.

What to do: Update Chrome for Android to 153.0.8010.52 or later via the Google Play Store (check the actual version at chrome://version, as Play Store rollout can lag). Enable automatic Chrome updates and avoid untrusted web pages until updated; desktop Chrome users should also apply the Chrome 153 update, which addresses 16 flaws in the same release.