Cross-Origin Information Leak via Permissions in Google Chrome Before 153.0.8010.52
AI analysis
CVE-2026-93383 is an information disclosure flaw (CWE-200) in the Permissions component of Google Chrome, fixed in version 153.0.8010.52. A remote attacker can trigger the flaw by luring a user to a specially crafted HTML page, which causes the browser to leak data from cross-origin sites in violation of the same-origin policy. An attacker gains access to content or data from other origins that the victim's browser has access to, potentially including sensitive page content from other sites. All users of Google Chrome versions prior to 153.0.8010.52 are affected. No public proof-of-concept is known, the issue is not listed in CISA's KEV catalog, and exploitation has not been confirmed in the wild.
What to do: Update Google Chrome to version 153.0.8010.52 or later (verify via chrome://settings/help or chrome://version) and restart the browser to complete the update; ensure automatic updates are enabled for managed fleets. As interim mitigation, exercise caution with untrusted websites, since exploitation requires rendering a crafted HTML page. Treat this as a medium-severity, low-friction patch and roll it out with the regular Chrome 153 update cycle, which also addresses two critical vulnerabilities.
Affected
| Google Chrome | all versions prior to 153.0.8010.52 |
Estimated exposure
massbillions of Chrome installations (Chrome's global user base exceeds 3 billion), though the auto-updating stable channel shrinks the vulnerable population… — Chrome is the world's dominant desktop browser with billions of users, so effectively the entire Chrome installed base on versions before 153.0.8010.52 is potentially affected; the flaw is triggered client-side by visiting a crafted page…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.