CVE-2026-93385

An information leak exists in the Paint component of Google Chrome that allows a remote attacker to obtain sensitive information by tricking a user into visiting a crafted HTML page. The flaw is classified as CWE-200 (Exposure of Sensitive Information) and carries a Medium severity rating from the Chromium security team. All users of Google Chrome prior to version 153.0.8010.52 are affected across the platforms on which Chrome ships. Successful exploitation yields access to sensitive information from the browser's rendering/painting process, but the flaw does not permit arbitrary code execution. No public proof-of-concept is known and the issue is not in CISA's KEV catalog; it was patched as one of 16 vulnerabilities in the Chrome 153.0.8010.52 release.

What to do: Update Google Chrome to version 153.0.8010.52 or later (check via chrome://settings/help or deploy the updated MSI/enterprise package). Because the flaw is triggered by a crafted HTML page, instruct users to avoid untrusted links until patching is complete. Note that the same release fixes 15 other issues including two critical vulnerabilities, so apply the 153.0.8010.52 update promptly and completely.