ZeroHour

CVE-2026-93379

mass

Site Isolation Bypass via Incorrect ORB Authorization in Google Chrome

CVSS 3.1
4.3 medium
EPSS
Published
()
Modified
AI analysis

CVE-2026-93379 is an incorrect authorization flaw (CWE-863) in the ORB (Opaque Response Blocking) component of Google Chrome that allows a remote attacker to bypass the browser's site isolation protections. The flaw is triggered when a victim loads a specially crafted HTML page, for example via a malicious or compromised website. A successful attacker could circumvent site isolation, the boundary that is supposed to keep content from one site separate from another, potentially enabling access to cross-origin data that should be isolated. Anyone running Google Chrome prior to version 153.0.8010.52 is affected, which effectively spans the browser's entire multi-billion-user installed base until they update. There are currently no known public proofs of concept, no reports of exploitation in the wild, and the issue is not listed in CISA's KEV catalog; it was patched in Chrome 153, which fixes 16 security issues including two critical ones.

What to do: Update Google Chrome to 153.0.8010.52 or later (verify via chrome://settings/help and restart the browser to fully apply the patch). Since no PoC or in-the-wild exploitation is known, prompt patching is the primary action; enterprises should push the updated version through their browser update management and confirm fleet versions. Users who cannot update immediately should exercise caution with untrusted links, as exploitation requires loading a crafted HTML page.

Affected
Google ChromeAll versions prior to 153.0.8010.52
Estimated exposure
mass≈3+ billion Chrome installations worldwide (entire pre-153.0.8010.52 installed base) — Chrome is the world's dominant browser with roughly 3–4 billion users per public market-share estimates, and every installation older than 153.0.8010.52 is affected until it auto-updates.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Weakness
CWE-863
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

In the news

Google Chrome 153 Update Fixes 16 Security Flaws, Including Two Critical Vulnerabilities

Google released Chrome 153 fixing 16 vulnerabilities, including critical use-after-free in Dawn/WebGPU and a WebGL buffer overflow, across Windows, macOS, and Linux.

Chrome 153.0.8010.52 for the Stable desktop channel patches 16 flaws, including critical CVE-2026-93374, a use-after-free in Dawn (Chromium's WebGPU implementation), and critical CVE-2026-93372, a WebGL buffer overflow. High-severity fixes cover use-after-free and buffer overflow bugs in PDFium, incorrect state validation in Skia, a use-after-free in Extensions, incorrect authorization in ORB, and type confusion in V8. Google restricts technical exploit details until most users have updated; a browser restart is required to activate the patch.

Chrome 153 Patches 16 Security Vulnerabilities Including Critical Dawn and WebGL Flaws

Google released Chrome 153 fixing 16 flaws, including critical use-after-free in Dawn (CVE-2026-93374) and buffer overflow in WebGL (CVE-2026-93372).

Google shipped Chrome 153.0.8010.52/.53 for Windows, macOS, and Linux, patching 16 vulnerabilities: 2 critical, 8 high, 5 medium, and 1 low. The critical flaws are a use-after-free in Dawn, Chrome's WebGPU implementation (CVE-2026-93374), and a WebGL buffer overflow (CVE-2026-93372). High-severity fixes include a V8 type confusion (CVE-2026-93377), two PDFium bugs, and issues in Skia, Extensions, ORB, and Tracing. No exploitation is reported; Google is withholding technical details until most users have updated.