CVE-2026-93379

CVE-2026-93379 is an incorrect authorization flaw (CWE-863) in the ORB (Opaque Response Blocking) component of Google Chrome that allows a remote attacker to bypass the browser's site isolation protections. The flaw is triggered when a victim loads a specially crafted HTML page, for example via a malicious or compromised website. A successful attacker could circumvent site isolation, the boundary that is supposed to keep content from one site separate from another, potentially enabling access to cross-origin data that should be isolated. Anyone running Google Chrome prior to version 153.0.8010.52 is affected, which effectively spans the browser's entire multi-billion-user installed base until they update. There are currently no known public proofs of concept, no reports of exploitation in the wild, and the issue is not listed in CISA's KEV catalog; it was patched in Chrome 153, which fixes 16 security issues including two critical ones.

What to do: Update Google Chrome to 153.0.8010.52 or later (verify via chrome://settings/help and restart the browser to fully apply the patch). Since no PoC or in-the-wild exploitation is known, prompt patching is the primary action; enterprises should push the updated version through their browser update management and confirm fleet versions. Users who cannot update immediately should exercise caution with untrusted links, as exploitation requires loading a crafted HTML page.