Google Chrome CVE-2026-93380

Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process (a prior, separate vulnerability), then leverage social engineering to make the victim open a crafted HTML page, and finally win a filesystem race condition (TOCTOU) to bypass system access restrictions. Limiting factors: it is not a standalone entry point (needs pre-existing renderer compromise), it requires user interaction (UI:R), and the race condition gives high attack complexity (AC:H) meaning exploitation is timing-dependent and unreliable. Affects Chrome versions prior to 153.0.8010.52; patched builds are not exploitable.

This is a low-real-risk, low-CVSS issue despite being a network-vector browser flaw. The vendor CVSS 3.1 score of 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) is honest: exploitation carries high attack complexity (AC:H, inherent to winning a TOCTOU race), requires user interaction (UI:R via social engineering to open a crafted page), and - critically - the description states the attacker must ALREADY have compromised the renderer process. That precondition, not captured in the CVSS PR metric (kept at PR:N because no Chrome-level authentication is bypassed), means this is only useful as a secondary link in a chain, never a standalone entry point. Impact is limited (C:N/I:L/A:N - a limited bypass of system access restrictions, i.e. partial filesystem-sandbox boundary weakening). No EPSS score, no CISA KEV listing, and no public POC were provided; per the precision rules this is 'no public exploit identified at time of analysis.' Chromium itself rated it Medium. Conflicting signal to flag: the input Tags label this 'Authentication Bypass,' but CWE-367 and the description make clear it is a race-condition/TOCTOU sandbox-restriction bypass, not an authentication bypass - verify tag before triage. Net: real code fix worth patching via normal Chrome auto-update cadence, but not an urgent standalone priority.

An attacker who has already exploited a separate renderer-process bug lures a victim into visiting a crafted HTML page and wins a filesystem race condition (TOCTOU) to bypass system access restrictions and reach files outside the sandbox's intended limits. No public exploit code was identified; the high attack complexity (race-window timing) and dependency on prior renderer compromise plus user interaction make this a chained, opportunistic technique rather than a reliable one-shot.