ZeroHour

CVE-2026-93380

mass

TOCTOU Race Condition in Google Chrome FileSystem Bypasses Access Restrictions

CVSS 3.1
3.1 low
EPSS
Published
()
Modified
AI analysis

Google Chrome's FileSystem implementation contains a time-of-check to time-of-use (TOCTOU) race condition (CWE-367) that allows system access restrictions to be bypassed. Triggering it requires a crafted HTML page, an attacker who has already compromised the renderer process via a separate flaw, and social engineering to persuade the user, per Google's advisory. Successful exploitation lets the attacker bypass system access restrictions; Chromium rates the issue Medium severity. All Chrome users running versions earlier than 153.0.8010.52 are affected until they update. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; the fix shipped in Chrome 153, which addresses 16 vulnerabilities including two critical ones.

What to do: Update Google Chrome to 153.0.8010.52 or later via chrome://settings/help and restart the browser; verify auto-update is enabled across your fleet. Because this flaw is designed to be chained from a compromised renderer plus user interaction, prioritize applying the full Chrome 153 release (16 fixes, including two critical ones). Check endpoint management or browser update reporting tools to confirm no clients remain on pre-153 builds.

Affected
Google Chromeall versions prior to 153.0.8010.52
Estimated exposure
mass≈3+ billion Chrome users (all builds before 153.0.8010.52) — Chrome is the world's dominant desktop browser with on the order of 3–4 billion active users, and every build prior to 153.0.8010.52 is affected, though practical exploitability is limited by the need to first compromise the renderer and…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Weakness
CWE-367
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

In the news

Google Chrome 153 Update Fixes 16 Security Flaws, Including Two Critical Vulnerabilities

Google released Chrome 153 fixing 16 vulnerabilities, including critical use-after-free in Dawn/WebGPU and a WebGL buffer overflow, across Windows, macOS, and Linux.

Chrome 153.0.8010.52 for the Stable desktop channel patches 16 flaws, including critical CVE-2026-93374, a use-after-free in Dawn (Chromium's WebGPU implementation), and critical CVE-2026-93372, a WebGL buffer overflow. High-severity fixes cover use-after-free and buffer overflow bugs in PDFium, incorrect state validation in Skia, a use-after-free in Extensions, incorrect authorization in ORB, and type confusion in V8. Google restricts technical exploit details until most users have updated; a browser restart is required to activate the patch.

Chrome 153 Patches 16 Security Vulnerabilities Including Critical Dawn and WebGL Flaws

Google released Chrome 153 fixing 16 flaws, including critical use-after-free in Dawn (CVE-2026-93374) and buffer overflow in WebGL (CVE-2026-93372).

Google shipped Chrome 153.0.8010.52/.53 for Windows, macOS, and Linux, patching 16 vulnerabilities: 2 critical, 8 high, 5 medium, and 1 low. The critical flaws are a use-after-free in Dawn, Chrome's WebGPU implementation (CVE-2026-93374), and a WebGL buffer overflow (CVE-2026-93372). High-severity fixes include a V8 type confusion (CVE-2026-93377), two PDFium bugs, and issues in Skia, Extensions, ORB, and Tracing. No exploitation is reported; Google is withholding technical details until most users have updated.