Google Chrome CVE-2026-93375

Exploitation requires the attacker to already have local execution ability on the target Windows machine and to run a malicious 'local program' that abuses Chrome's Tracing component's incorrect reference resolution (CWE-706). It applies only to Chrome on Windows prior to 153.0.8010.52. Limiting factors: the attack vector is local (AV:L) - not remotely exploitable over the network - and attack complexity is high (AC:H), implying a race or timing-dependent condition that is not reliably repeatable. No user interaction is needed (UI:N) and no prior Chrome-level privileges are required (PR:N), but the prerequisite local foothold means this is realistically a chained sandbox-escape stage rather than a standalone initial-access vulnerability.

This is a genuinely high-severity code-execution flaw (vendor CVSS 8.1) but the CVSS vector materially tempers real-world urgency: AV:L means the attacker must already be able to run a 'local program' on the target host - this is not remotely reachable. AC:H further indicates the exploit is non-trivial (likely a race or timing-dependent reference-resolution condition in Chrome's Tracing component). The redeeming severity comes from S:C with C:H/I:H/A:H - successful exploitation escapes the Chrome sandbox, so it functions as a sandbox-escape / privilege-boundary bypass that would be chained onto a separate remote code-execution primitive in a real attack. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is: no public exploit identified at time of analysis. Bottom line: not a drop-everything remote 0-day - the local-access + AC:H gating makes this a real but second-stage / chained priority rather than an internet-facing emergency. Note the vector's PR:N is unusual for a local flaw but consistent with 'any local program' being sufficient; no conflict requiring vendor verification was found beyond that.

An attacker who has already achieved low-privilege code execution on a Windows host (e.g., via a malicious renderer payload or a previously-dropped local program) invokes Chrome's Tracing functionality in a way that triggers incorrect reference resolution. By winning the required race/timing condition (AC:H), the malicious local program manipulates the resolved reference to execute code in the higher-privileged browser-process context, escaping the renderer sandbox (S:C). No public proof-of-concept is identified in the available data.