CVE-2026-93380

Google Chrome's FileSystem implementation contains a time-of-check to time-of-use (TOCTOU) race condition (CWE-367) that allows system access restrictions to be bypassed. Triggering it requires a crafted HTML page, an attacker who has already compromised the renderer process via a separate flaw, and social engineering to persuade the user, per Google's advisory. Successful exploitation lets the attacker bypass system access restrictions; Chromium rates the issue Medium severity. All Chrome users running versions earlier than 153.0.8010.52 are affected until they update. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; the fix shipped in Chrome 153, which addresses 16 vulnerabilities including two critical ones.

What to do: Update Google Chrome to 153.0.8010.52 or later via chrome://settings/help and restart the browser; verify auto-update is enabled across your fleet. Because this flaw is designed to be chained from a compromised renderer plus user interaction, prioritize applying the full Chrome 153 release (16 fixes, including two critical ones). Check endpoint management or browser update reporting tools to confirm no clients remain on pre-153 builds.