Intel

CVE-2026-93385

Chromium CVE-2026-93385: Information leak in Paint

mediumEPSS 0.3%

Description

Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Source: Debian Security AdvisoriesMicrosoft Security Update GuideNVD (NIST)cvelistv5BSI WID PortalBSI CSAF

Affected operating systems

  • linux

    debian / chromiumtrixie

Metrics

XIEM Effective CVSS
6.5
Source: cna-v3
EPSS percentile
22.1 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
medium
Priority score
66.41
Exploit maturity
no public PoC known
CVSS v3
6.5
EPSS score
0.3 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-09-30 20:25 UTC
CWE
CWE-200

Weakness classes (CWE)

  • CWE-200Class

    Exposure of Sensitive Information to an Unauthorized Actor

    The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-09-18 17:19 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 153.0.8010.52
    • Reference Type: Chrome: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html Types: Release Notes, Vendor Advisory
    • Reference Type: Chrome: https://issues.chromium.org/issues/553136980 Types: Permissions Required
  2. CVE Modified2026-09-18 14:19 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    • SSVC: {"id":"CVE-2026-93385","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
  3. New CVE Received2026-09-17 21:17 UTC· chrome-cve-admin@google.com
    • Description: Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
    • CWE: CWE-200
    • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/93xxx/CVE-2026-93385.json">CVE-2026-93385</a>
    • Reference: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html