CVE-2026-93374

This is a defect in the part of the browser that handles graphics. It is like a shop’s lock being removed but the door still being used: a malicious web page may exploit that mistake to break out of the browser and interfere with the phone.

This matters to you if staff use Google Chrome on Android phones or tablets for work, especially to access email, banking, customer systems, or company accounts. An attacker does not need an account, but someone must open a specially made web page.

An attacker can target staff through a malicious web page and potentially run harmful code beyond the browser, so treat this as urgent. It is not listed in CISA’s known-exploited catalog, and no clear dated report confirms active exploitation, but the flaw is critical and has a vendor update available.

Confirm exposure by inventorying Android devices and checking the installed Google Chrome version in Settings → About Chrome or through your mobile-device-management console. Update affected devices to 153.0.8010.52 or later; no alternative fixed branch is provided in the findings.

Use the normal Google Play Store or managed-device update path. This is a browser update, not a code-package dependency, and the findings do not identify a breaking-change concern.

If updating is delayed, restrict use of the browser for work accounts where practical and warn users not to open unsolicited links or pages. There is no CISA KEV remediation deadline because this CVE is not listed in KEV. Monitor device-management reports for successful updates and investigate unusual browser crashes or unexpected account activity.

CVE-2026-93374 is rated CVSS 9.6 Critical (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). It is CWE-416, a use-after-free in Dawn, with network delivery through crafted HTML; authentication is not required, while user interaction is required. The reported outcome is browser instability and potential arbitrary code execution outside the sandbox. It is not in CISA KEV, no public exploit code is recorded, and no clear dated press claim confirms exploitation. EPSS is 0.4% (29th percentile) with a flat trend.