Google Chrome Stable Update Fixes Two Vulnerabilities (CVE-2026-93385, CVE-2026-93386)

What happened

Google released a Stable Channel update for Chrome on desktop that resolves two security issues. CVE-2026-93385 is an information leak in the Paint component, rated Medium severity by Chromium's internal severity classification. CVE-2026-93386 is a UI misrepresentation issue in WebAppInstalls, rated Low severity. Both were fixed in Chrome 153.0.8010.52.

Technical cause

CVE-2026-93385 (CWE-200, Exposure of Sensitive Information) stems from a flaw in Chrome's Paint component that allowed a remote attacker to obtain sensitive information through a crafted HTML page. CVE-2026-93386 (CWE-451, User Interface Misrepresentation of Critical Information) is located in the WebAppInstalls component and allowed an attacker to spoof UI elements via a crafted HTML page, requiring social engineering to succeed.

Why it matters

CVE-2026-93385 could allow an attacker to read sensitive information from a visited page without the user noticing anything unusual, which is why it carries a higher confidentiality impact rating. CVE-2026-93386 could be used to make a malicious or misleading UI element appear legitimate, potentially aiding social engineering attacks, though its direct impact is lower since it does not grant access to data or system control on its own.

Who is affected

Any user running Google Chrome on desktop prior to version 153.0.8010.52 is affected by both vulnerabilities. Both issues require the victim to visit a specially crafted HTML page and involve some level of user interaction to be exploited.

Affected versions

Google Chrome versions prior to 153.0.8010.52 are affected by both CVE-2026-93385 and CVE-2026-93386. The exact starting version range for either flaw was not specified in the available vendor information.

Fixes and mitigation

Google has fixed both vulnerabilities in Chrome version 153.0.8010.52, released through the Stable Channel for desktop. Users should ensure their browser updates automatically or manually trigger an update check via Chrome's settings.

Recommended action

Update Google Chrome to version 153.0.8010.52 or later as soon as possible. Most installations update automatically on restart, but administrators managing Chrome deployments in organizational environments should verify that the update has been applied across all endpoints.