CVE-2026-93377

CVE-2026-93377 is a type confusion flaw (CWE-843) in V8, the JavaScript engine used by Google Chrome. An attacker triggers it by convincing a user to open a specially crafted HTML page, meaning successful attacks require a social-engineering step such as a phishing link. If exploited, the attacker can execute arbitrary code within the Chrome renderer sandbox, limiting but not eliminating the impact of the compromise. All Chrome users running versions prior to 153.0.8010.52 are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time; the fix shipped in Chrome 153, which addressed 16 security issues in total.

What to do: Update Google Chrome to 153.0.8010.52 or later on all platforms (check via chrome://settings/help), and force the update across managed fleets using enterprise update policies. Because exploitation requires luring users to a crafted page, reinforce phishing awareness and verify the browser version on high-risk endpoints.