Chromium: Seven Vulnerabilities Patched in Single Google Chrome Update

Key findings

• Seven vulnerabilities in Google Chrome disclosed on September 17, 2026, patched in version 153.0.8010.52.
• Includes three High severity flaws: incorrect authorization (ORB), use-after-free (Extensions), and arbitrary code execution (Tracing).
• Vulnerabilities impact site isolation, code execution, information leaks, and UI spoofing.
• Attack vectors include remote and local exploits, crafted HTML, PDFs, and extensions.
• All issues addressed in a single Chrome version update.

On September 17, 2026, a batch of seven vulnerabilities affecting Google Chrome was disclosed, all patched in version 153.0.8010.52. The vulnerabilities span various components including WebAppInstalls, Permissions, ORB, Storage, DataTransfer, Tracing, and Extensions, with severities ranging from Low to High. These disclosures highlight ongoing security challenges within the widely used browser.

Several vulnerabilities focus on bypassing Chrome's security mechanisms. CVE-2026-93379 (High) involves an incorrect authorization flaw in ORB that could allow a remote attacker to bypass site isolation. Similarly, CVE-2026-93378 (Medium) is a missing authorization issue in Storage, potentially enabling an attacker who has compromised the renderer process to bypass site isolation via a crafted PDF.

Other vulnerabilities present risks of code execution and information disclosure. CVE-2026-93373 (High), a use-after-free flaw in Extensions, could permit a remote attacker to execute arbitrary code via a malicious Chrome extension. On Windows, CVE-2026-93375 (High) in Tracing, when exploited by a local attacker, could lead to arbitrary code execution outside the sandbox. Additionally, CVE-2026-93383 (Medium) is an information leak in Permissions, allowing a remote attacker to exfiltrate cross-origin data.

The batch also includes vulnerabilities with more specific attack vectors. CVE-2026-93386 (Low) is a UI misrepresentation in WebAppInstalls, which could be exploited by a remote attacker leveraging social engineering to spoof UI elements through a malicious HTML page. A local attacker could exploit CVE-2026-93376 (Medium) in DataTransfer, which is an out-of-bounds read, to read memory outside the sandbox via a local program.

All seven vulnerabilities were addressed in Google Chrome version 153.0.8010.52. Users are strongly advised to update to this version or later to mitigate the risks associated with these security flaws. The consistent patching across multiple components in this single release underscores the importance of timely updates for maintaining browser security.

This coordinated disclosure of seven vulnerabilities, including three rated High, emphasizes the continuous need for vigilance in securing web browsers. Users should ensure their Chrome installations are up-to-date to protect against potential exploitation of these issues. The variety of affected components and attack vectors highlights the multifaceted nature of browser security.