Critical WebGL Buffer Overflow in Google Chrome for Android
CVE-2026-93372 is a buffer overflow (CWE-121) in the WebGL component of Google Chrome on Android, fixed in Chrome 153.0.8010.52. A remote attacker can trigger it by luring a user to a crafted HTML page that renders malicious WebGL content, causing memory corruption in the browser process. Successful exploitation allows arbitrary code execution outside the sandbox, which defeats Chrome's key containment boundary and grants the attacker significantly broader access on the device. All Chrome for Android users running versions prior to 153.0.8010.52 are affected; the flaw carries a Critical Chromium security severity rating. There is currently no evidence of exploitation in the wild, no public proof-of-concept, and the issue is not on CISA's KEV list; it was patched as one of 16 flaws in the Chrome 153 release.
· Google Chrome for Android all versions prior to 153.0.8010.52mass
Use-After-Free in Dawn (WebGPU) in Chrome for Android Enables Sandbox-Escape RCE
CVE-2026-93374 is a use-after-free memory-corruption flaw in Dawn, the WebGPU component of Google Chrome, affecting Chrome on Android prior to version 153.0.8010.52. An attacker can trigger it remotely by convincing a user to open a specially crafted HTML page. Successful exploitation could allow arbitrary code execution outside the browser's security sandbox, which is a severe outcome because it escapes Chrome's core containment mechanism. All users of Chrome for Android on unpatched versions are affected; Google rates the flaw Critical and shipped the fix in Chrome 153, which patched 16 vulnerabilities including two critical ones. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the issue is not yet on CISA's KEV list.
· Google Chrome for Android (Dawn/WebGPU component) All versions prior to 153.0.8010.52mass
Use-after-free in Google Chrome Extensions Enables Sandbox-Escape Code Execution
CVE-2026-93373 is a use-after-free memory corruption bug (CWE-416) in the Extensions component of Google Chrome. An attacker can trigger it by getting a user to load a crafted Chrome extension, which frees memory that is subsequently reused. Successful exploitation allows a remote attacker to execute arbitrary code outside the browser's sandbox, meaning the code escapes Chrome's strongest isolation layer and runs with broader system privileges. All Chrome users running versions prior to 153.0.8010.52 are affected, and Google has patched the flaw in that release as part of an update fixing 16 security issues, including two critical vulnerabilities. There is currently no evidence of exploitation in the wild, no CISA KEV listing, and no known public proof-of-concept.
· Google Chrome all versions prior to 153.0.8010.52mass
Type Confusion in V8 Allows Sandbox-Restricted Code Execution in Google Chrome
CVE-2026-93377 is a type confusion flaw (CWE-843) in V8, the JavaScript engine used by Google Chrome. An attacker triggers it by convincing a user to open a specially crafted HTML page, meaning successful attacks require a social-engineering step such as a phishing link. If exploited, the attacker can execute arbitrary code within the Chrome renderer sandbox, limiting but not eliminating the impact of the compromise. All Chrome users running versions prior to 153.0.8010.52 are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time; the fix shipped in Chrome 153, which addressed 16 security issues in total.
· Google Chrome all versions prior to 153.0.8010.52mass
Information Leak in Google Chrome Paint Component Prior to 153.0.8010.52
An information leak exists in the Paint component of Google Chrome that allows a remote attacker to obtain sensitive information by tricking a user into visiting a crafted HTML page. The flaw is classified as CWE-200 (Exposure of Sensitive Information) and carries a Medium severity rating from the Chromium security team. All users of Google Chrome prior to version 153.0.8010.52 are affected across the platforms on which Chrome ships. Successful exploitation yields access to sensitive information from the browser's rendering/painting process, but the flaw does not permit arbitrary code execution. No public proof-of-concept is known and the issue is not in CISA's KEV catalog; it was patched as one of 16 vulnerabilities in the Chrome 153.0.8010.52 release.
· Google Chrome prior to 153.0.8010.52mass
Out-of-Bounds Read in Google Chrome DataTransfer Prior to 153.0.8010.52
CVE-2026-93376 is an out-of-bounds read (CWE-125) in the DataTransfer component of Google Chrome, fixed in version 153.0.8010.52. A local attacker must use social engineering to convince a user to run a local program, which then interacts with Chrome in a way that reads memory outside the browser sandbox. Successful exploitation yields disclosure of memory contents from outside the sandbox, an information-exposure issue rather than code execution, and Chromium rates it Medium severity. All users running Chrome versions prior to 153.0.8010.52 are affected, and the fix shipped as part of the Chrome 153 release that addressed 16 security flaws, including two critical ones. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation has been reported.
· Google Chrome prior to 153.0.8010.52mass
Cross-Origin Information Leak via Permissions in Google Chrome Before 153.0.8010.52
CVE-2026-93383 is an information disclosure flaw (CWE-200) in the Permissions component of Google Chrome, fixed in version 153.0.8010.52. A remote attacker can trigger the flaw by luring a user to a specially crafted HTML page, which causes the browser to leak data from cross-origin sites in violation of the same-origin policy. An attacker gains access to content or data from other origins that the victim's browser has access to, potentially including sensitive page content from other sites. All users of Google Chrome versions prior to 153.0.8010.52 are affected. No public proof-of-concept is known, the issue is not listed in CISA's KEV catalog, and exploitation has not been confirmed in the wild.
· Google Chrome all versions prior to 153.0.8010.52mass
Cross-Origin Data Leak via Improper State Validation in Google Chrome Skia
CVE-2026-93387 is an improper state validation flaw in Skia, the graphics rendering library used by Google Chrome, affecting Chrome versions prior to 153.0.8010.52. An attacker triggers it by luring a victim to a crafted HTML page, which causes Skia to mishandle rendering state and break the same-origin policy. A successful attack allows a remote attacker to read cross-origin data from other sites the victim has open or authenticated to, potentially exposing sensitive page content, tokens, or account information. All Chrome users on pre-153 builds are affected, and the flaw was rated High severity by the Chromium team; Google shipped the fix in the Chrome 153 release alongside 15 other security fixes. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.
· Google Chrome all versions prior to 153.0.8010.52mass
Server-Side Request Forgery in Omnibox in Google Chrome for Android
CVE-2026-93384 is a server-side request forgery (SSRF) flaw in the Omnibox (address bar) component of Google Chrome running on Android. It can be triggered by a remote attacker who uses social engineering to induce user actions, causing the browser to send crafted network traffic that bypasses system access restrictions. A successful exploit lets the attacker reach resources or services that should be blocked by those restrictions, though the Medium Chromium severity and social-engineering requirement limit the practical impact. Only Chrome on Android is named in the advisory; affected versions are those prior to 153.0.8010.52. There are no reports of exploitation in the wild, no public proof of concept, and the flaw is not listed in CISA's KEV; the fix shipped in Chrome 153.0.8010.52, which addresses 16 security flaws in total, including two critical ones.
· Google Chrome (Android) prior to 153.0.8010.52mass
Missing-Authorization Storage Flaw Bypasses Site Isolation in Google Chrome PDFs
CVE-2026-93378 is a missing-authorization (CWE-862) flaw in the Storage component of Google Chrome, where storage operations fail to properly enforce origin checks. To trigger it, an attacker who has already compromised a renderer process (for example via a chained memory-corruption bug) induces the victim to open a crafted PDF file. Successful exploitation lets the attacker bypass Chrome's site isolation, meaning code in a compromised renderer could potentially access cross-origin data belonging to other sites — a defense-in-depth defeat typically used to escalate a renderer compromise into cross-site data theft. Anyone running Google Chrome before 153.0.8010.52 is affected; the issue is rated Medium by Chromium and was fixed in the Chrome 153.0.8010.52 release, which addressed 16 total flaws including two critical ones. There is no known exploitation, no public proof-of-concept, and the flaw is not listed in CISA KEV.
· Google Chrome all versions prior to 153.0.8010.52mass