CVE-2026-93378

CVE-2026-93378 is a missing-authorization (CWE-862) flaw in the Storage component of Google Chrome, where storage operations fail to properly enforce origin checks. To trigger it, an attacker who has already compromised a renderer process (for example via a chained memory-corruption bug) induces the victim to open a crafted PDF file. Successful exploitation lets the attacker bypass Chrome's site isolation, meaning code in a compromised renderer could potentially access cross-origin data belonging to other sites — a defense-in-depth defeat typically used to escalate a renderer compromise into cross-site data theft. Anyone running Google Chrome before 153.0.8010.52 is affected; the issue is rated Medium by Chromium and was fixed in the Chrome 153.0.8010.52 release, which addressed 16 total flaws including two critical ones. There is no known exploitation, no public proof-of-concept, and the flaw is not listed in CISA KEV.

What to do: Update Google Chrome to 153.0.8010.52 or later immediately (Menu > Help > About Chrome forces the auto-update) and confirm the version at chrome://version. Because exploitation requires an already-compromised renderer, treat this as a chaining target and ensure all renderer/memory-safety fixes from this release are applied as well. No workaround is practical since PDF viewing is built in; rely on prompt patching.