CVE-2026-93375

CVE-2026-93375 is an incorrect reference resolution flaw (CWE-706) in the Tracing component of Google Chrome on Windows. A local attacker who can already run a program on the machine can abuse the flaw to potentially execute arbitrary code outside the Chrome sandbox, meaning code escapes the browser's process-isolation boundary. Successful exploitation typically serves as a sandbox escape that can be chained with other browser flaws for fuller system compromise. Only Chrome on Windows prior to 153.0.8010.52 is affected; the fix shipped in the Chrome 153.0.8010.52 release, which addressed 16 security issues including two critical ones. No public proof-of-concept is known, the issue is not on the CISA KEV list, and no in-the-wild exploitation has been confirmed.

What to do: Update Google Chrome on Windows to version 153.0.8010.52 or later immediately (via Settings > About Chrome or your enterprise update channel) and verify the version at chrome://version. Because exploitation requires a local program, prioritize patching shared, multi-user, and kiosk-style Windows systems where local code execution by untrusted users is more likely. No mitigation short of upgrading is published; restrict local program execution on sensitive machines in the interim.