Google Chrome CVE-2026-93384

Exploitation requires the affected component to be Google Chrome on Android prior to 153.0.8010.52, specifically the Omnibox (address/search bar). The attacker must leverage social engineering to induce the victim, and craft network traffic that triggers the SSRF; per the CVSS vector attack complexity is High (AC:H), meaning conditions beyond the attacker's control must align. Limiting factors: mobile-only (Android) scope, no privileges needed (PR:N) but effective reliance on user manipulation (the description's social-engineering element conflicts with the vector's UI:N), and impact capped at bypassing system access restrictions with low integrity effect only - no confidentiality or availability compromise, no code execution.

This is a low-priority, low-real-risk issue despite being a network-vector SSRF in a ubiquitous browser. The vendor CVSS 3.1 base score is only 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N): high attack complexity, no confidentiality or availability impact, and only low integrity impact. All exploitation signals point down: SSVC reports Exploitation 'none', Automatable 'no', and Technical Impact 'partial'; there is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis. Chromium itself rated this Medium. There is a notable data conflict: the CVSS vector encodes UI:N (no user interaction) yet the description explicitly states the attacker is 'leveraging social engineering,' which normally maps to UI:R - verify with vendor, as a corrected UI:R would leave the score essentially unchanged or slightly lower. Net: real footprint is enormous (Chrome on Android) but the constrained impact (integrity-only SSRF used to bypass system access restrictions, no data theft or RCE) plus high complexity and required social engineering make this far below priorities like the concurrent Chrome V8/PDFium RCEs in the same 153.0.8010.52 release.

An attacker tricks an Android Chrome user (via a malicious link or page - the social-engineering element) into triggering the Omnibox to emit crafted network traffic that the SSRF weakness routes past system access restrictions to an otherwise-restricted internal or local endpoint. The impact is limited to low integrity (issuing an unauthorized request), with no data exfiltration or code execution. No public proof-of-concept exists, and high attack complexity makes reliable exploitation difficult.