CVE-2026-93383: 
Google Chrome vulnerability analysis and mitigation

CVE-2026-93383 is an information leak vulnerability in the Permissions component of Google Chrome that allows a remote attacker to leak cross-origin data via a crafted HTML page. It affects all versions of Google Chrome prior to 153.0.8010.52 on Windows, Mac, and Linux. The vulnerability was reported internally by Google on 2026-05-22 and publicly disclosed on 2026-09-17 as part of a 16-fix stable channel update. It carries a Chromium security severity rating of Medium, with an EPSS score of 0.0 (Chrome Releases, GitHub Advisory).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and resides in Chrome's Permissions subsystem. A remote attacker can exploit this flaw by serving a specially crafted HTML page that causes the browser to inadvertently expose data from cross-origin contexts, violating the same-origin policy. The bug was tracked internally as Chromium issue #515493668 and was discovered and reported by Google's own security team. No public technical write-up or proof-of-concept code has been released (Chrome Releases, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to leak cross-origin data from a victim's browser session, potentially exposing sensitive information such as authentication tokens, session cookies, or page content from other origins. The attack requires only that the victim visit a malicious HTML page, making it a low-barrier, client-side attack. While the impact is limited to data disclosure (confidentiality) with no direct integrity or availability consequences, leaked cross-origin data could facilitate further attacks such as session hijacking or credential theft (Chrome Releases, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog, and its EPSS score is 0.0, indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported (GitHub Advisory).

Google has released a patch in Chrome stable channel version 153.0.8010.52 (Linux) and 153.0.8010.52/.53 (Windows and Mac), which addresses this vulnerability along with 15 other security fixes. Users should update Google Chrome to version 153.0.8010.52 or later immediately. As a precautionary measure prior to patching, users should avoid visiting untrusted websites or opening suspicious HTML files from unknown sources (Chrome Releases).

GBHackers reported on the Chrome 153 update, noting it fixes 16 security flaws including CVE-2026-93383. No significant independent researcher commentary or notable social media discussion has been identified for this specific CVE beyond standard vulnerability aggregator coverage (GBHackers).