AI analysis
CVE-2026-93384 is a server-side request forgery (SSRF) flaw in the Omnibox (address bar) component of Google Chrome running on Android. It can be triggered by a remote attacker who uses social engineering to induce user actions, causing the browser to send crafted network traffic that bypasses system access restrictions. A successful exploit lets the attacker reach resources or services that should be blocked by those restrictions, though the Medium Chromium severity and social-engineering requirement limit the practical impact. Only Chrome on Android is named in the advisory; affected versions are those prior to 153.0.8010.52. There are no reports of exploitation in the wild, no public proof of concept, and the flaw is not listed in CISA's KEV; the fix shipped in Chrome 153.0.8010.52, which addresses 16 security flaws in total, including two critical ones.
What to do: Update Chrome on Android to version 153.0.8010.52 or later via Google Play (Settings > About Chrome > check for updates) and relaunch the browser. Given the Medium severity and social-engineering prerequisite, this is not an emergency patch, but applying it promptly also picks up the two critical fixes in the same Chrome 153 release. Desktop and other Chrome builds should still be kept current per Google's regular update channel.
Affected
| Google Chrome (Android) | prior to 153.0.8010.52 |
Estimated exposure
massbillions of users (Chrome is the dominant browser on Android, which has 3B+ active devices) — Chrome holds roughly 60%+ of the mobile browser market and ships as the default browser on Android's 3B+ active devices, so nearly all Chrome-for-Android installs below 153.0.8010.52 are plausibly affected.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.