CVE-2026-93383

CVE-2026-93383 is an information disclosure flaw (CWE-200) in the Permissions component of Google Chrome, fixed in version 153.0.8010.52. A remote attacker can trigger the flaw by luring a user to a specially crafted HTML page, which causes the browser to leak data from cross-origin sites in violation of the same-origin policy. An attacker gains access to content or data from other origins that the victim's browser has access to, potentially including sensitive page content from other sites. All users of Google Chrome versions prior to 153.0.8010.52 are affected. No public proof-of-concept is known, the issue is not listed in CISA's KEV catalog, and exploitation has not been confirmed in the wild.

What to do: Update Google Chrome to version 153.0.8010.52 or later (verify via chrome://settings/help or chrome://version) and restart the browser to complete the update; ensure automatic updates are enabled for managed fleets. As interim mitigation, exercise caution with untrusted websites, since exploitation requires rendering a crafted HTML page. Treat this as a medium-severity, low-friction patch and roll it out with the regular Chrome 153 update cycle, which also addresses two critical vulnerabilities.