Intel

CVE-2026-93386

Chromium CVE-2026-93386: UI misrepresentation in WebAppInstalls

mediumEPSS 0.3%

Description

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Source: Debian Security AdvisoriesBSI WID PortalBSI CSAFMicrosoft Security Update GuideNVD (NIST)cvelistv5

Affected operating systems

  • linux

    debian / chromiumtrixie

Metrics

XIEM Effective CVSS
5.4
Source: cna-v3
EPSS percentile
15.0 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
medium
Priority score
58.80
Exploit maturity
no public PoC known
CVSS v3
5.4
EPSS score
0.3 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-09-30 20:25 UTC
CWE
CWE-451

Weakness classes (CWE)

  • CWE-451Class

    User Interface (UI) Misrepresentation of Critical Information

    The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-09-18 17:18 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 153.0.8010.52
    • Reference Type: Chrome: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html Types: Release Notes, Vendor Advisory
    • Reference Type: Chrome: https://issues.chromium.org/issues/513996595 Types: Permissions Required
  2. CVE Modified2026-09-18 14:19 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
    • SSVC: {"id":"CVE-2026-93386","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
  3. New CVE Received2026-09-17 21:17 UTC· chrome-cve-admin@google.com
    • Description: UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
    • CWE: CWE-451
    • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/93xxx/CVE-2026-93386.json">CVE-2026-93386</a>
    • Reference: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html