Google Chrome CVE-2026-93379

Requires the victim to actively load a crafted HTML page in Google Chrome prior to 153.0.8010.52 (UI:R user interaction is mandatory) - there is no unauthenticated server-side or drive-through-default path that works without the user opening attacker content. No authentication is required of the attacker (PR:N), but exploitation is limited by: (1) needing the victim to visit attacker-controlled web content, (2) the bug yielding only limited cross-site read access (C:L) rather than code execution or a full same-origin-policy break, and (3) applicability only to unpatched Chrome versions below 153.0.8010.52. Site isolation is a defense-in-depth boundary, so impact is data disclosure across sites rather than host compromise.

This is a genuine but low-severity issue that does not warrant emergency prioritization. The vendor CVSS3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) is internally consistent: network-reachable, no privileges, but requires the victim to visit an attacker-controlled page (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effect. The 'Chromium security severity: High' label reflects the class of bug (a site-isolation / same-origin boundary bypass in ORB) rather than the real-world impact of this specific instance, which is why the CVSS base score is only 4.3 - a common divergence for Chromium browser-security-boundary bugs. Key exploitation signals are absent: no EPSS score, not listed in CISA KEV, and no public proof-of-concept identified in the provided data - so there is no evidence of active exploitation or imminent commoditization. One defensible disagreement: because bypassing site isolation lets a page reach data belonging to another origin/site, an S:C (scope change) rating is arguable and would raise the score to roughly 5.0; the vendor chose S:U. Net: real, patch-worthy via routine browser update cadence, but not an actively-exploited high-priority threat on the available evidence.

An attacker hosts a crafted HTML page and lures a Chrome user (pre-153.0.8010.52) to visit it, e.g. via a link or malicious ad. The page abuses incorrect authorization in ORB (Opaque Response Blocking) to bypass site isolation and read a limited amount of cross-site data the renderer should not be able to access. No public exploit code is identified in the provided data, and exploitation requires user interaction (visiting the page).