CVE-2026-93378: Google Chrome vulnerability

Q: What access does an attacker need before this issue can be exploited?

The attacker must already have compromised the Chrome renderer process. The bypass is then triggered using a crafted PDF file.

Q: What is the security impact after exploitation?

A compromised renderer can bypass Chrome site isolation, weakening the isolation boundary between sites.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.52 are affected.

Published Sep 17, 2026

Updated

Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.52

Event History

Sep 17, 2026

CVE Published

via MITRE·09:08 PM

Data Sourced

via MITRE·09:08 PM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need before this issue can be exploited?

The attacker must already have compromised the Chrome renderer process. The bypass is then triggered using a crafted PDF file.

What is the security impact after exploitation?

A compromised renderer can bypass Chrome site isolation, weakening the isolation boundary between sites.

Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.52 are affected.